@atensec/pulumi-thoth 0.1.3 → 0.1.4

package/governance/getEvidenceBundle.ts

@@ -0,0 +1,47 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getEvidenceBundle(args: GetEvidenceBundleArgs, opts?: pulumi.InvokeOptions): Promise<GetEvidenceBundleResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getEvidenceBundle:getEvidenceBundle", {
+        "sessionId": args.sessionId,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEvidenceBundle.
+ */
+export interface GetEvidenceBundleArgs {
+    sessionId: string;
+}
+
+/**
+ * A collection of values returned by getEvidenceBundle.
+ */
+export interface GetEvidenceBundleResult {
+    readonly bundleHash: string;
+    readonly exportedAt: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly responseJson: string;
+    readonly sessionId: string;
+    readonly summaryJson: string;
+}
+export function getEvidenceBundleOutput(args: GetEvidenceBundleOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetEvidenceBundleResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getEvidenceBundle:getEvidenceBundle", {
+        "sessionId": args.sessionId,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEvidenceBundle.
+ */
+export interface GetEvidenceBundleOutputArgs {
+    sessionId: pulumi.Input<string>;
+}

package/governance/getEvidenceChain.ts

@@ -0,0 +1,53 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getEvidenceChain(args?: GetEvidenceChainArgs, opts?: pulumi.InvokeOptions): Promise<GetEvidenceChainResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getEvidenceChain:getEvidenceChain", {
+        "fromSequence": args.fromSequence,
+        "limit": args.limit,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEvidenceChain.
+ */
+export interface GetEvidenceChainArgs {
+    fromSequence?: number;
+    limit?: number;
+}
+
+/**
+ * A collection of values returned by getEvidenceChain.
+ */
+export interface GetEvidenceChainResult {
+    readonly dataJson: string;
+    readonly fromSequence?: number;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly limit?: number;
+    readonly responseJson: string;
+    readonly total: number;
+}
+export function getEvidenceChainOutput(args?: GetEvidenceChainOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetEvidenceChainResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getEvidenceChain:getEvidenceChain", {
+        "fromSequence": args.fromSequence,
+        "limit": args.limit,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEvidenceChain.
+ */
+export interface GetEvidenceChainOutputArgs {
+    fromSequence?: pulumi.Input<number | undefined>;
+    limit?: pulumi.Input<number | undefined>;
+}

package/governance/getEvidenceVerify.ts

@@ -0,0 +1,50 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getEvidenceVerify(args?: GetEvidenceVerifyArgs, opts?: pulumi.InvokeOptions): Promise<GetEvidenceVerifyResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getEvidenceVerify:getEvidenceVerify", {
+        "limit": args.limit,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEvidenceVerify.
+ */
+export interface GetEvidenceVerifyArgs {
+    limit?: number;
+}
+
+/**
+ * A collection of values returned by getEvidenceVerify.
+ */
+export interface GetEvidenceVerifyResult {
+    readonly breachDetail: string;
+    readonly chainHead: number;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly limit?: number;
+    readonly recordsChecked: number;
+    readonly responseJson: string;
+    readonly verified: boolean;
+}
+export function getEvidenceVerifyOutput(args?: GetEvidenceVerifyOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetEvidenceVerifyResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getEvidenceVerify:getEvidenceVerify", {
+        "limit": args.limit,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEvidenceVerify.
+ */
+export interface GetEvidenceVerifyOutputArgs {
+    limit?: pulumi.Input<number | undefined>;
+}

package/governance/getPacks.ts

@@ -0,0 +1,28 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getPacks(opts?: pulumi.InvokeOptions): Promise<GetPacksResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getPacks:getPacks", {
+    }, opts);
+}
+
+/**
+ * A collection of values returned by getPacks.
+ */
+export interface GetPacksResult {
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly packsJson: string;
+    readonly total: number;
+}
+export function getPacksOutput(opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetPacksResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getPacks:getPacks", {
+    }, opts);
+}

package/governance/getReportsOverview.ts

@@ -0,0 +1,46 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getReportsOverview(args?: GetReportsOverviewArgs, opts?: pulumi.InvokeOptions): Promise<GetReportsOverviewResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getReportsOverview:getReportsOverview", {
+        "days": args.days,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getReportsOverview.
+ */
+export interface GetReportsOverviewArgs {
+    days?: number;
+}
+
+/**
+ * A collection of values returned by getReportsOverview.
+ */
+export interface GetReportsOverviewResult {
+    readonly days?: number;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly responseJson: string;
+}
+export function getReportsOverviewOutput(args?: GetReportsOverviewOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetReportsOverviewResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getReportsOverview:getReportsOverview", {
+        "days": args.days,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getReportsOverview.
+ */
+export interface GetReportsOverviewOutputArgs {
+    days?: pulumi.Input<number | undefined>;
+}

package/governance/getRuntimeStatus.ts

@@ -0,0 +1,46 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getRuntimeStatus(args?: GetRuntimeStatusArgs, opts?: pulumi.InvokeOptions): Promise<GetRuntimeStatusResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getRuntimeStatus:getRuntimeStatus", {
+        "environment": args.environment,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getRuntimeStatus.
+ */
+export interface GetRuntimeStatusArgs {
+    environment?: string;
+}
+
+/**
+ * A collection of values returned by getRuntimeStatus.
+ */
+export interface GetRuntimeStatusResult {
+    readonly environment?: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly responseJson: string;
+}
+export function getRuntimeStatusOutput(args?: GetRuntimeStatusOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetRuntimeStatusResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getRuntimeStatus:getRuntimeStatus", {
+        "environment": args.environment,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getRuntimeStatus.
+ */
+export interface GetRuntimeStatusOutputArgs {
+    environment?: pulumi.Input<string | undefined>;
+}

package/governance/{tenantSettings.ts → governanceSettings.ts}

@@ -4,9 +4,9 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as utilities from "../utilities";
 
-export class TenantSettings extends pulumi.CustomResource {
+export class GovernanceSettings extends pulumi.CustomResource {
     /**
-     * Get an existing TenantSettings resource's state with the given name, ID, and optional extra
+     * Get an existing GovernanceSettings resource's state with the given name, ID, and optional extra
      * properties used to qualify the lookup.
      *
      * @param name The _unique_ name of the resulting resource.
@@ -14,22 +14,22 @@ export class TenantSettings extends pulumi.CustomResource {
      * @param state Any extra arguments used during the lookup.
      * @param opts Optional settings to control the behavior of the CustomResource.
      */
-    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: TenantSettingsState, opts?: pulumi.CustomResourceOptions): TenantSettings {
-        return new TenantSettings(name, <any>state, { ...opts, id: id });
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: GovernanceSettingsState, opts?: pulumi.CustomResourceOptions): GovernanceSettings {
+        return new GovernanceSettings(name, <any>state, { ...opts, id: id });
     }
 
     /** @internal */
-    public static readonly __pulumiType = 'thoth:governance/tenantSettings:TenantSettings';
+    public static readonly __pulumiType = 'thoth:governance/governanceSettings:GovernanceSettings';
 
     /**
-     * Returns true if the given object is an instance of TenantSettings.  This is designed to work even
+     * Returns true if the given object is an instance of GovernanceSettings.  This is designed to work even
      * when multiple copies of the Pulumi SDK have been loaded into the same process.
      */
-    public static isInstance(obj: any): obj is TenantSettings {
+    public static isInstance(obj: any): obj is GovernanceSettings {
         if (obj === undefined || obj === null) {
             return false;
         }
-        return obj['__pulumiType'] === TenantSettings.__pulumiType;
+        return obj['__pulumiType'] === GovernanceSettings.__pulumiType;
     }
 
     /**
@@ -64,34 +64,6 @@ export class TenantSettings extends pulumi.CustomResource {
      * Failover provider order.
      */
     declare public readonly modelRouterFailoverProviders: pulumi.Output<string[] | undefined>;
-    /**
-     * Shared secret for PAM callback validation.
-     */
-    declare public readonly pamCallbackSecret: pulumi.Output<string | undefined>;
-    /**
-     * Enable PAM step-up callback integration.
-     */
-    declare public readonly pamEnabled: pulumi.Output<boolean | undefined>;
-    /**
-     * PAM provider slug.
-     */
-    declare public readonly pamProvider: pulumi.Output<string | undefined>;
-    /**
-     * Outbound PAM auth token.
-     */
-    declare public readonly pamRequestAuthToken: pulumi.Output<string | undefined>;
-    /**
-     * Outbound PAM request secret.
-     */
-    declare public readonly pamRequestSecret: pulumi.Output<string | undefined>;
-    /**
-     * Outbound PAM request timeout in seconds.
-     */
-    declare public readonly pamRequestTimeoutSeconds: pulumi.Output<number | undefined>;
-    /**
-     * Outbound PAM request URL.
-     */
-    declare public readonly pamRequestUrl: pulumi.Output<string | undefined>;
     /**
      * Allowed host patterns for secret broker.
      */
@@ -132,34 +104,10 @@ export class TenantSettings extends pulumi.CustomResource {
      * Default action for medium risk events.
      */
     declare public readonly shadowMedium: pulumi.Output<string | undefined>;
-    /**
-     * SIEM provider slug.
-     */
-    declare public readonly siemProvider: pulumi.Output<string | undefined>;
-    /**
-     * Enable SIEM webhook delivery.
-     */
-    declare public readonly siemWebhookEnabled: pulumi.Output<boolean | undefined>;
-    /**
-     * SIEM webhook provider slug.
-     */
-    declare public readonly siemWebhookProvider: pulumi.Output<string | undefined>;
-    /**
-     * SIEM webhook signing secret.
-     */
-    declare public readonly siemWebhookSecret: pulumi.Output<string | undefined>;
-    /**
-     * SIEM webhook URL.
-     */
-    declare public readonly siemWebhookUrl: pulumi.Output<string | undefined>;
     /**
      * Tenant ID resolved from provider configuration.
      */
     declare public /*out*/ readonly tenantId: pulumi.Output<string>;
-    /**
-     * Run webhook test endpoint after applying settings.
-     */
-    declare public readonly testWebhookOnApply: pulumi.Output<boolean | undefined>;
     /**
      * Tool-specific risk tier overrides.
      */
@@ -168,32 +116,20 @@ export class TenantSettings extends pulumi.CustomResource {
      * Last update timestamp returned by GovAPI.
      */
     declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
-    /**
-     * Enable outbound webhook delivery.
-     */
-    declare public readonly webhookEnabled: pulumi.Output<boolean | undefined>;
-    /**
-     * Webhook signing secret.
-     */
-    declare public readonly webhookSecret: pulumi.Output<string | undefined>;
-    /**
-     * Outbound webhook URL.
-     */
-    declare public readonly webhookUrl: pulumi.Output<string | undefined>;
 
     /**
-     * Create a TenantSettings resource with the given unique name, arguments, and options.
+     * Create a GovernanceSettings resource with the given unique name, arguments, and options.
      *
      * @param name The _unique_ name of the resource.
      * @param args The arguments to use to populate this resource's properties.
      * @param opts A bag of options that control this resource's behavior.
      */
-    constructor(name: string, args?: TenantSettingsArgs, opts?: pulumi.CustomResourceOptions)
-    constructor(name: string, argsOrState?: TenantSettingsArgs | TenantSettingsState, opts?: pulumi.CustomResourceOptions) {
+    constructor(name: string, args?: GovernanceSettingsArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: GovernanceSettingsArgs | GovernanceSettingsState, opts?: pulumi.CustomResourceOptions) {
         let resourceInputs: pulumi.Inputs = {};
         opts = opts || {};
         if (opts.id) {
-            const state = argsOrState as TenantSettingsState | undefined;
+            const state = argsOrState as GovernanceSettingsState | undefined;
             resourceInputs["complianceProfile"] = state?.complianceProfile;
             resourceInputs["extraSettingsJson"] = state?.extraSettingsJson;
             resourceInputs["modelRouterAllowedModels"] = state?.modelRouterAllowedModels;
@@ -202,13 +138,6 @@ export class TenantSettings extends pulumi.CustomResource {
             resourceInputs["modelRouterDefaultProvider"] = state?.modelRouterDefaultProvider;
             resourceInputs["modelRouterEnabled"] = state?.modelRouterEnabled;
             resourceInputs["modelRouterFailoverProviders"] = state?.modelRouterFailoverProviders;
-            resourceInputs["pamCallbackSecret"] = state?.pamCallbackSecret;
-            resourceInputs["pamEnabled"] = state?.pamEnabled;
-            resourceInputs["pamProvider"] = state?.pamProvider;
-            resourceInputs["pamRequestAuthToken"] = state?.pamRequestAuthToken;
-            resourceInputs["pamRequestSecret"] = state?.pamRequestSecret;
-            resourceInputs["pamRequestTimeoutSeconds"] = state?.pamRequestTimeoutSeconds;
-            resourceInputs["pamRequestUrl"] = state?.pamRequestUrl;
             resourceInputs["secretBrokerAllowedHosts"] = state?.secretBrokerAllowedHosts;
             resourceInputs["secretBrokerAuthBindingsJson"] = state?.secretBrokerAuthBindingsJson;
             resourceInputs["secretBrokerEnabled"] = state?.secretBrokerEnabled;
@@ -219,20 +148,11 @@ export class TenantSettings extends pulumi.CustomResource {
             resourceInputs["shadowHigh"] = state?.shadowHigh;
             resourceInputs["shadowLow"] = state?.shadowLow;
             resourceInputs["shadowMedium"] = state?.shadowMedium;
-            resourceInputs["siemProvider"] = state?.siemProvider;
-            resourceInputs["siemWebhookEnabled"] = state?.siemWebhookEnabled;
-            resourceInputs["siemWebhookProvider"] = state?.siemWebhookProvider;
-            resourceInputs["siemWebhookSecret"] = state?.siemWebhookSecret;
-            resourceInputs["siemWebhookUrl"] = state?.siemWebhookUrl;
             resourceInputs["tenantId"] = state?.tenantId;
-            resourceInputs["testWebhookOnApply"] = state?.testWebhookOnApply;
             resourceInputs["toolRiskOverrides"] = state?.toolRiskOverrides;
             resourceInputs["updatedAt"] = state?.updatedAt;
-            resourceInputs["webhookEnabled"] = state?.webhookEnabled;
-            resourceInputs["webhookSecret"] = state?.webhookSecret;
-            resourceInputs["webhookUrl"] = state?.webhookUrl;
         } else {
-            const args = argsOrState as TenantSettingsArgs | undefined;
+            const args = argsOrState as GovernanceSettingsArgs | undefined;
             resourceInputs["complianceProfile"] = args?.complianceProfile;
             resourceInputs["extraSettingsJson"] = args?.extraSettingsJson;
             resourceInputs["modelRouterAllowedModels"] = args?.modelRouterAllowedModels;
@@ -241,13 +161,6 @@ export class TenantSettings extends pulumi.CustomResource {
             resourceInputs["modelRouterDefaultProvider"] = args?.modelRouterDefaultProvider;
             resourceInputs["modelRouterEnabled"] = args?.modelRouterEnabled;
             resourceInputs["modelRouterFailoverProviders"] = args?.modelRouterFailoverProviders;
-            resourceInputs["pamCallbackSecret"] = args?.pamCallbackSecret ? pulumi.secret(args.pamCallbackSecret) : undefined;
-            resourceInputs["pamEnabled"] = args?.pamEnabled;
-            resourceInputs["pamProvider"] = args?.pamProvider;
-            resourceInputs["pamRequestAuthToken"] = args?.pamRequestAuthToken ? pulumi.secret(args.pamRequestAuthToken) : undefined;
-            resourceInputs["pamRequestSecret"] = args?.pamRequestSecret ? pulumi.secret(args.pamRequestSecret) : undefined;
-            resourceInputs["pamRequestTimeoutSeconds"] = args?.pamRequestTimeoutSeconds;
-            resourceInputs["pamRequestUrl"] = args?.pamRequestUrl;
             resourceInputs["secretBrokerAllowedHosts"] = args?.secretBrokerAllowedHosts;
             resourceInputs["secretBrokerAuthBindingsJson"] = args?.secretBrokerAuthBindingsJson;
             resourceInputs["secretBrokerEnabled"] = args?.secretBrokerEnabled;
@@ -258,30 +171,19 @@ export class TenantSettings extends pulumi.CustomResource {
             resourceInputs["shadowHigh"] = args?.shadowHigh;
             resourceInputs["shadowLow"] = args?.shadowLow;
             resourceInputs["shadowMedium"] = args?.shadowMedium;
-            resourceInputs["siemProvider"] = args?.siemProvider;
-            resourceInputs["siemWebhookEnabled"] = args?.siemWebhookEnabled;
-            resourceInputs["siemWebhookProvider"] = args?.siemWebhookProvider;
-            resourceInputs["siemWebhookSecret"] = args?.siemWebhookSecret ? pulumi.secret(args.siemWebhookSecret) : undefined;
-            resourceInputs["siemWebhookUrl"] = args?.siemWebhookUrl;
-            resourceInputs["testWebhookOnApply"] = args?.testWebhookOnApply;
             resourceInputs["toolRiskOverrides"] = args?.toolRiskOverrides;
-            resourceInputs["webhookEnabled"] = args?.webhookEnabled;
-            resourceInputs["webhookSecret"] = args?.webhookSecret ? pulumi.secret(args.webhookSecret) : undefined;
-            resourceInputs["webhookUrl"] = args?.webhookUrl;
             resourceInputs["tenantId"] = undefined /*out*/;
             resourceInputs["updatedAt"] = undefined /*out*/;
         }
         opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
-        const secretOpts = { additionalSecretOutputs: ["pamCallbackSecret", "pamRequestAuthToken", "pamRequestSecret", "siemWebhookSecret", "webhookSecret"] };
-        opts = pulumi.mergeOptions(opts, secretOpts);
-        super(TenantSettings.__pulumiType, name, resourceInputs, opts);
+        super(GovernanceSettings.__pulumiType, name, resourceInputs, opts);
     }
 }
 
 /**
- * Input properties used for looking up and filtering TenantSettings resources.
+ * Input properties used for looking up and filtering GovernanceSettings resources.
  */
-export interface TenantSettingsState {
+export interface GovernanceSettingsState {
     /**
      * Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
      */
@@ -314,34 +216,6 @@ export interface TenantSettingsState {
      * Failover provider order.
      */
     modelRouterFailoverProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-    /**
-     * Shared secret for PAM callback validation.
-     */
-    pamCallbackSecret?: pulumi.Input<string | undefined>;
-    /**
-     * Enable PAM step-up callback integration.
-     */
-    pamEnabled?: pulumi.Input<boolean | undefined>;
-    /**
-     * PAM provider slug.
-     */
-    pamProvider?: pulumi.Input<string | undefined>;
-    /**
-     * Outbound PAM auth token.
-     */
-    pamRequestAuthToken?: pulumi.Input<string | undefined>;
-    /**
-     * Outbound PAM request secret.
-     */
-    pamRequestSecret?: pulumi.Input<string | undefined>;
-    /**
-     * Outbound PAM request timeout in seconds.
-     */
-    pamRequestTimeoutSeconds?: pulumi.Input<number | undefined>;
-    /**
-     * Outbound PAM request URL.
-     */
-    pamRequestUrl?: pulumi.Input<string | undefined>;
     /**
      * Allowed host patterns for secret broker.
      */
@@ -382,34 +256,10 @@ export interface TenantSettingsState {
      * Default action for medium risk events.
      */
     shadowMedium?: pulumi.Input<string | undefined>;
-    /**
-     * SIEM provider slug.
-     */
-    siemProvider?: pulumi.Input<string | undefined>;
-    /**
-     * Enable SIEM webhook delivery.
-     */
-    siemWebhookEnabled?: pulumi.Input<boolean | undefined>;
-    /**
-     * SIEM webhook provider slug.
-     */
-    siemWebhookProvider?: pulumi.Input<string | undefined>;
-    /**
-     * SIEM webhook signing secret.
-     */
-    siemWebhookSecret?: pulumi.Input<string | undefined>;
-    /**
-     * SIEM webhook URL.
-     */
-    siemWebhookUrl?: pulumi.Input<string | undefined>;
     /**
      * Tenant ID resolved from provider configuration.
      */
     tenantId?: pulumi.Input<string | undefined>;
-    /**
-     * Run webhook test endpoint after applying settings.
-     */
-    testWebhookOnApply?: pulumi.Input<boolean | undefined>;
     /**
      * Tool-specific risk tier overrides.
      */
@@ -418,24 +268,12 @@ export interface TenantSettingsState {
      * Last update timestamp returned by GovAPI.
      */
     updatedAt?: pulumi.Input<string | undefined>;
-    /**
-     * Enable outbound webhook delivery.
-     */
-    webhookEnabled?: pulumi.Input<boolean | undefined>;
-    /**
-     * Webhook signing secret.
-     */
-    webhookSecret?: pulumi.Input<string | undefined>;
-    /**
-     * Outbound webhook URL.
-     */
-    webhookUrl?: pulumi.Input<string | undefined>;
 }
 
 /**
- * The set of arguments for constructing a TenantSettings resource.
+ * The set of arguments for constructing a GovernanceSettings resource.
  */
-export interface TenantSettingsArgs {
+export interface GovernanceSettingsArgs {
     /**
      * Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
      */
@@ -468,34 +306,6 @@ export interface TenantSettingsArgs {
      * Failover provider order.
      */
     modelRouterFailoverProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-    /**
-     * Shared secret for PAM callback validation.
-     */
-    pamCallbackSecret?: pulumi.Input<string | undefined>;
-    /**
-     * Enable PAM step-up callback integration.
-     */
-    pamEnabled?: pulumi.Input<boolean | undefined>;
-    /**
-     * PAM provider slug.
-     */
-    pamProvider?: pulumi.Input<string | undefined>;
-    /**
-     * Outbound PAM auth token.
-     */
-    pamRequestAuthToken?: pulumi.Input<string | undefined>;
-    /**
-     * Outbound PAM request secret.
-     */
-    pamRequestSecret?: pulumi.Input<string | undefined>;
-    /**
-     * Outbound PAM request timeout in seconds.
-     */
-    pamRequestTimeoutSeconds?: pulumi.Input<number | undefined>;
-    /**
-     * Outbound PAM request URL.
-     */
-    pamRequestUrl?: pulumi.Input<string | undefined>;
     /**
      * Allowed host patterns for secret broker.
      */
@@ -536,44 +346,8 @@ export interface TenantSettingsArgs {
      * Default action for medium risk events.
      */
     shadowMedium?: pulumi.Input<string | undefined>;
-    /**
-     * SIEM provider slug.
-     */
-    siemProvider?: pulumi.Input<string | undefined>;
-    /**
-     * Enable SIEM webhook delivery.
-     */
-    siemWebhookEnabled?: pulumi.Input<boolean | undefined>;
-    /**
-     * SIEM webhook provider slug.
-     */
-    siemWebhookProvider?: pulumi.Input<string | undefined>;
-    /**
-     * SIEM webhook signing secret.
-     */
-    siemWebhookSecret?: pulumi.Input<string | undefined>;
-    /**
-     * SIEM webhook URL.
-     */
-    siemWebhookUrl?: pulumi.Input<string | undefined>;
-    /**
-     * Run webhook test endpoint after applying settings.
-     */
-    testWebhookOnApply?: pulumi.Input<boolean | undefined>;
     /**
      * Tool-specific risk tier overrides.
      */
     toolRiskOverrides?: pulumi.Input<{[key: string]: pulumi.Input<string>} | undefined>;
-    /**
-     * Enable outbound webhook delivery.
-     */
-    webhookEnabled?: pulumi.Input<boolean | undefined>;
-    /**
-     * Webhook signing secret.
-     */
-    webhookSecret?: pulumi.Input<string | undefined>;
-    /**
-     * Outbound webhook URL.
-     */
-    webhookUrl?: pulumi.Input<string | undefined>;
 }