Governance Setup

Initialize the governance framework in the current project. Guide the user through each step with confirmations.

Scope and When to Use

Use /governance-setup when setting up a new project or adding governance to an existing one. This is a one-time initialization — it creates DOMAIN.md, the ADR directory, and optionally installs rules.

Not needed if the project already has DOMAIN.md and docs/adr/. For ongoing checks, use /governance-check or the governance-reviewer agent.

Prerequisites

Check if governance artifacts already exist:

• DOMAIN.md in project root
• docs/adr/ directory
• ~/.claude/rules/governance.md

Report what exists and what will be created.

Workflow

1. Create DOMAIN.md

If DOMAIN.md doesn't exist, ask the user: "What is this project about? Briefly describe the main entities/domain objects."

Then generate a DOMAIN.md using the template from the plugin's examples/DOMAIN.md.example, customized with the user's entities. Include:

• Core entities with fields, types, constraints
• Invariants for each entity
• API contract rules (if applicable)
• Data standards

2. Set Up ADR Directory

Create docs/adr/ if it doesn't exist. Copy the ADR template:

mkdir -p docs/adr

Create docs/adr/ADR-001-adopt-governance-framework.md as the first ADR documenting the decision to adopt governance.

3. Create Data Classification (Optional)

Ask the user: "Would you like to create a DATA-CLASSIFICATION.md for tracking data sensitivity levels? (Recommended for projects handling PII or credentials)"

If yes, copy from ${CLAUDE_PLUGIN_ROOT}/examples/DATA-CLASSIFICATION.md.example and customize:

• Ask about data elements the project handles
• Set appropriate classification levels (Public/Internal/Confidential/Restricted)
• Document AI/LLM data flows if applicable

Reference: OWASP DSGAI07.

3.5. Create Shadow AI Policy (Optional)

Ask: "Does your team use multiple AI tools? Would you like to document an approved AI tools policy?"

If yes, copy from ${CLAUDE_PLUGIN_ROOT}/examples/shadow-ai-policy.md and customize:

• List approved AI tools and their data access levels
• Define prohibited patterns (unsanctioned tools)
• Set review cadence

Reference: OWASP DSGAI03.

4. Install Rules (Optional)

Ask the user: "Would you like to install governance rules to ~/.claude/rules/? This enables fitness function checks across all your projects."

Options:

• "Yes — install all 5 rules (governance, coding-style, git-workflow, testing, security)"
• "Just governance rule"
• "Skip — I'll manage rules myself"

If they choose to install, copy from the plugin's examples/rules/ directory:

cp ${CLAUDE_PLUGIN_ROOT}/examples/rules/*.md ~/.claude/rules/

5. Update CLAUDE.md (Optional)

Ask if they want to add a governance section to their project's CLAUDE.md. If yes, add:

## Decision Autonomy (Three Loops Model)

### Out-of-Loop (AI executes autonomously)

- Code formatting, linting fixes
- Import organization, unused variable removal
- Simple bug fixes with clear root cause

### On-the-Loop (AI proposes, human approves)

- New feature implementation (use Plan Mode)
- API endpoint changes
- Refactoring > 3 files

### In-the-Loop (Human decides, AI assists)

- Architecture decisions
- Security model changes
- Breaking changes

6. Summary

Print a summary of what was created:

Governance initialized:
- DOMAIN.md — domain model (edit to match your entities)
- docs/adr/ — architecture decision records
- docs/adr/ADR-001 — governance adoption record
- DATA-CLASSIFICATION.md — data sensitivity inventory (if created)
- ~/.claude/rules/ — fitness function rules (if installed)

Next steps:
1. Edit DOMAIN.md to define your actual entities
2. Review DATA-CLASSIFICATION.md for data handling compliance
3. Run /governance-check to verify your project
4. Use /spec-driven-dev for new features
5. Use /create-adr to record decisions