As product managers build more applications with AI, organizations need a structured way to manage what gets deployed, who can deploy it, and which capabilities each application is allowed to use. The governance page in Aha! Builder gives governance administrators a central place to track every application in the account, set default rules that control application capabilities, and create rules templates for different types of applications.
This article discusses functionality that is available to Aha! Builder Team and Scale plans.
Click any of the following links to skip ahead:
Access the governance page
Navigate to the Governance tab in the top navigation bar. The governance page opens to the Overview tab.
To access the governance page, you need two things: an Aha! Builder seat and the governance administrator role. Account, billing, and customizations administrators do not have access to the governance page.
If you do not see the Governance tab, ask an account administrator to grant you governance administrator permissions. Navigate to User menu -> Settings -> Account -> Users, open the user record, and under Product administration check Aha! Builder governance.
Applications
The Applications tab lists every application in your account in a configurable report view. Use it to monitor deployment status, authentication methods, rules template assignments, and security review results across all applications at a glance.
The default columns include:
Application name: The name of the application. Click a name to open the application.
Deployment status: Whether the application is enabled, disabled, or not deployed yet.
Application authentication: The authentication methods configured for the application.
Application rules template: The rules template assigned to the application, or Default if it uses the account default rules.
Application tags: Any tags applied to the application.
Application last active date: The most recent date when the application had user or deployment activity.
Click the gear icon to customize the view. Select Edit data to add or remove columns, Sort columns to change the display order, or Save view to keep your configuration. Available columns include all eight security and privacy review fields — Secure by design, OWASP Top 10, Static code analysis, Dependency vulnerability scan, PII data, GDPR compliance, CCPA compliance, and Cookie usage — along with Application creator, Creation date, Status, Description, and more.
Use the Deployment status dropdown to filter applications by status, or click the Filter icon to add custom filters.
Click the more options menu on any application row to view:
Secrets: View the secrets configured for the application.
API requests: View the external domains the application makes requests to.
Delete: Permanently delete the application. This action cannot be undone.
Default rules
The Default rules tab controls which capabilities are available across all applications in your account. Default rules apply to every application unless an application is assigned a rules template that overrides them.
There are six rule categories:
Limit authentication methods: Restrict which authentication providers are available for applications. Toggle individual methods on or off — Password, Aha!, Google, GitHub, Microsoft, and SAML.
Note: SAML authentication is available on the Aha! Builder Scale plan.Workspace owners can deploy applications: When enabled, owners can deploy applications to production. When disabled, only governance administrators can deploy.
Applications can access the internet: When enabled, applications can make outbound network requests to external services and APIs. Disabling this also prevents applications from setting up working integrations with external tools.
Applications can send emails: When enabled, applications can send emails to users.
Enable AI usage: When enabled, builders can include Elle in their applications. Elle usage in applications consumes Aha! Builder AI credits.
Application owners can share application code: When enabled, builders can can share their application's code for review with developers who do not have Aha! Builder seats.
Disabling a capability removes it for all users, even if their role would normally allow it. Enabling a capability does not elevate permissions beyond what account settings or role permissions already grant.
Click Save changes to save your updates.
Rules templates
Not every application needs the same governance controls. A prototype might need permissive rules for fast iteration, while a production business application might need stricter authentication and deployment policies. Rules templates let you define named sets of rules and assign them to specific applications.
The Templates tab lists all templates in your account. Each row shows the template name, the applications assigned to it, and the dates the template was created and last modified. Click New template to create one.
Each template contains the same five rule categories as the default rules. When you assign a template to an application, the template rules override the account default rules for that application.