Interactive Builder

Build your govern.json

Configure 50+ governance checks, per-language rules, and 3-tier enforcement. Toggle options below — only non-default values are included.

Start Building
$ echo '{"version":"3.0","mode":"enforce"}' > govern.json
50+
Governance Checks
3-tier
Enforcement
13
Config Sections
12
Languages Governed
Project Starter Kit

Start a new NAAb project

Every NAAb project needs two files: govern.json for runtime enforcement and CLAUDE.md for LLM code generation. Download both to your project root.

govern.json

Complete governance template with all 50+ checks, per-language rules, and 3-tier enforcement. Customize to your project needs.
Download Template Use Builder

CLAUDE.md Template

Universal NAAb language reference for LLMs. Syntax rules, stdlib API, polyglot patterns, and 27 known gotchas. Download and rename to CLAUDE.md in your project.
Download CLAUDE.md View on GitHub
Quick Setup
mkdir my-project && cd my-project
curl -o CLAUDE.md https://raw.githubusercontent.com/b-macker/NAAb/master/CLAUDE-TEMPLATE.md
curl -O https://raw.githubusercontent.com/b-macker/NAAb/master/govern-template.json
mv govern-template.json govern.json
# Edit govern.json for your project, add project-specific sections to CLAUDE.md
Interactive Generator

Configure everything

Toggle options below. Only non-default values appear in your config.

Basics version, mode, description

▶
Inherit from a base config file

Languages allowed, blocked, per-language

▶
Require language to be in allowed list

Capabilities network, filesystem, shell, env, process

▶

Network

Network enabled
HTTPS only
WebSockets
Raw sockets

Filesystem

Shell

Shell enabled

Environment Variables

Read
Write

Process

Spawn processes

Limits timeout, execution, data, code

▶

Timeout (seconds)

Execution

Data

Code

Restrictions security checks, injection prevention

▶

Code Quality 21 checks: secrets, PII, complexity floor...

▶

Contracts runtime assertions on function return values

▶
Define return-value contracts per function. Checks: return_type, return_range, return_min/max, return_one_of, return_non_empty, return_keys, return_length_min/max, return_not_null.

Baselines record and compare outputs over time

▶
Enable output baselines
Auto-record on first run
Hash-based keys

Custom Rules regex pattern matching

▶

Output summary, errors, formatting, reports

▶

Summary

Show passing

Errors

Verbose
Show help
Show examples

File Reports

Audit logging, tamper evidence, provenance

▶

Tamper Evidence

Enable tamper evidence (hash chain)

Provenance

Record provenance
Sign records

Polyglot variable binding, output, parallel, persistent runtime

▶

Variable Binding

Require explicit variable binding

Output

Require JSON pipe
Require naab_return()

Parallel Execution

Persistent Runtime

Drift Tracking

Persist cross-language verification mismatches to JSONL for trend analysis.
Enable drift tracking
Include code hash

Project Context LLM files, linters, manifests

▶
Enable project context awareness

Sources

LLM files (CLAUDE.md, etc.)
Linter configs
Package manifests

Extraction

Language preferences
Banned patterns
Style rules
Show extractions
Feed into optimization
Dry run

Meta schema validation, inheritance, feature flags

▶

Schema Validation

Warn unknown keys
Suggest corrections

Inheritance

Environment

Allow env var substitution
Allow CLI override

Hooks on_violation, on_override, on_complete, pre/post_check

▶
govern.json 
{
  "version": "3.0",
  "mode": "enforce"
}
3-Tier Enforcement

Three levels of control

Every check in govern.json can be set to one of three enforcement levels.

HARD

Blocks execution

Cannot be overridden. Use for security-critical rules: injection, secrets, privilege escalation.

SOFT

Blocks execution

Can bypass with --governance-override. Use for quality gates: placeholders, debug artifacts, incomplete logic.

ADVISORY

Warns only

Continues execution with a warning. Use for style guidance: naming conventions, complexity, documentation.

CLI Reference

Governance CLI flags

CommandDescription
naab file.naabRun with auto-discovered govern.json (walks up directories)
--governance-overrideBypass soft enforcement blocks (hard blocks still enforced)
--governance-reportGenerate execution report
--governance-sarifOutput SARIF format report (for CI integration)
--governance-junitOutput JUnit XML report
Examples

Real-world configs

Personal Project

Just basic safety. Let everything run, block dangerous calls.
{
  "version": "3.0",
  "mode": "enforce",
  "languages": { "allowed": ["python", "javascript", "shell"] },
  "restrictions": {
    "dangerous_calls": { "level": "hard" }
  }
}

Open Source Library

Quality checks, no secrets, audit trail for contributors.
{
  "version": "3.0",
  "mode": "enforce",
  "languages": { "allowed": ["python", "javascript", "go"] },
  "code_quality": {
    "no_secrets": { "level": "hard" },
    "no_placeholders": { "level": "soft" },
    "no_debug_artifacts": { "level": "soft" }
  },
  "audit": { "level": "basic" }
}

Enterprise / Team

Full restrictions, custom rules, SARIF output for CI pipeline.
{
  "version": "3.0",
  "mode": "enforce",
  "languages": {
    "allowed": ["python", "javascript"],
    "per_language": {
      "python": {
        "banned_functions": ["eval(", "exec("],
        "imports": { "mode": "blocklist",
          "blocked": ["subprocess", "ctypes"] }
      }
    }
  },
  "restrictions": {
    "dangerous_calls": { "level": "hard" },
    "privilege_escalation": { "level": "hard" },
    "code_injection": { "level": "hard" }
  },
  "output": {
    "file_output": { "report_sarif": "governance.sarif" }
  }
}

AI Code Review Pipeline

Anti-hallucination. Catches stubs, fake APIs, simulation markers.
{
  "version": "3.0",
  "mode": "enforce",
  "code_quality": {
    "no_hallucinated_apis": { "level": "soft",
      "check_cross_language": true,
      "check_made_up_functions": true },
    "no_oversimplification": { "level": "hard",
      "check_empty_bodies": true,
      "check_fabricated_results": true },
    "no_incomplete_logic": { "level": "hard",
      "check_empty_catch": true },
    "no_simulation_markers": { "level": "hard" },
    "no_mock_data": { "level": "advisory" }
  }
}