# Control & govern

Decide who may do what, what agents may do on their own, where data may go and how it is protected.

Governance in Liyagent is enforced on the server, on every request. **Roles** say what a person may do in the console. **Cedar policies** say what any principal, person or agent, may do to any resource. **Tenants** keep customers or business units apart. **Redaction and sensitivity labels** keep data out of places it shouldn't reach. The audit log records all of it.