uipath-governance

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

UiPath Governance

UiPath 治理

Uber skill for UiPath governance authoring. Two backing CLI surfaces:

Surface	Governs	CLI
AOps product policy	Product feature behavior — what Studio / StudioX / Assistant / Robot / AI Trust Layer / Agent Builder can do at design-time / runtime	`uip gov aops-policy`
Access policy ( `ToolUsePolicy` )	Resource/tool-use boundary — when an Actor Process invokes a child Resource (Agent / Maestro / Flow / RPA / API / Case Management), is the call allowed?	`uip gov access-policy`

Both surfaces share verbs (

block

restrict

deny

allow

require

enforce

). The same English sentence often maps to either layer, so this skill classifies first and only then routes to the matching mechanic.

UiPath治理创作的全能技能。基于两个CLI界面：

界面	管控范围	CLI命令
AOps产品策略	产品功能行为——Studio / StudioX / Assistant / Robot / AI Trust Layer / Agent Builder在设计时/运行时可执行的操作	`uip gov aops-policy`
访问策略（ `ToolUsePolicy` ）	资源/工具使用边界——当参与者流程调用子资源（Agent / Maestro / Flow / RPA / API / 案例管理）时，是否允许该调用？	`uip gov access-policy`

两个界面共享相同的操作动词（

block

、

restrict

、

deny

、

allow

、

require

、

enforce

）。同一个英文表述通常可对应任意一层，因此本技能会先进行分类，再路由到匹配的机制。

When to Use This Skill

何时使用本技能

Activate on any governance / policy / rule intent — even when the user did not name the underlying CLI:

policy / rule / guardrail / govern / gate / control

requests

```
block / restrict / deny / disable / disallow
```
an action, model, app, URL, agent, flow, or process
```
require / enforce / mandate
```
a behavior or rule

allow only / permit only / limit to / restrict to

```
who can / which … can / on behalf of
```
— actor- or identity-shaped governance
```
compliance / posture / audit
```
framing on top of policies

.uipolicy

file path,

compliance standard

apply standard

Standard names:
```
ISO 42001
```

check compliance

compliance posture

posture against

drift check

is my tenant compliant

am I compliant with

organization-wide

all tenants

entire org

across all tenants

— org-scope full apply

只要涉及治理/策略/规则相关需求，即可激活本技能——即使用户未提及底层CLI：

包含

policy / rule / guardrail / govern / gate / control

的请求

要求
```
block / restrict / deny / disable / disallow
```
某项操作、模型、应用、URL、Agent、Flow或流程
要求
```
require / enforce / mandate
```
某种行为或规则

要求

allow only / permit only / limit to / restrict to

仅允许X

涉及
```
who can / which … can / on behalf of
```
——基于参与者或身份的治理
在策略之上的
```
compliance / posture / audit
```
框架

.uipolicy

文件路径、

compliance standard

、

apply standard

标准名称：
```
ISO 42001
```

check compliance

、

compliance posture

、

posture against

、

drift check

is my tenant compliant

、

am I compliant with

organization-wide

、

all tenants

、

entire org

、

across all tenants

——全组织范围的完整应用

Troubleshoot

故障排查

Investigate why a governance policy isn't taking effect
Debug deployment precedence (user > group > tenant override)
Evaluate access-policy rules against test scenarios (
```
access-policy evaluate
```
)
Troubleshoot blocked tool/workflow invocations
Audit which policies are deployed and to whom
Identify license-type / product mismatch causing silent no-ops

Sibling redirects:

Platform ops (auth, Orchestrator resources, packaging, deploy) →
```
uipath-platform
```
Authoring agents / workflows / RPA themselves →
```
uipath-agents
```
/
```
uipath-rpa
```
/
```
uipath-maestro-flow
```

调查治理策略未生效的原因
调试部署优先级（用户 > 组 > 租户覆盖）
根据测试场景评估访问策略规则（
```
access-policy evaluate
```
）
排查被阻止的工具/工作流调用
审计已部署的策略及其受众
识别导致静默无操作的许可证类型/产品不匹配问题

兄弟技能重定向：

平台运维（认证、Orchestrator资源、打包、部署）→
```
uipath-platform
```

Agent/工作流/RPA创作 →

uipath-agents

uipath-rpa

uipath-maestro-flow

Critical Rules

核心规则

Classify before authoring. First action on any governance request is to classify intent into Branch A (AOps) or Branch B (Access). Use the priors in
```
references/disambiguation-guide.md
```
. Never start
```
create
```
/
```
update
```
/
```
delete
```
until classification is settled — by user wording or by the disambiguation question.
Classification lives at the top. Mechanic libraries assume the branch is chosen. Do not let those flows ask "did you mean the other branch?" — that question belongs here.
One branch per mutation. A single user request produces a policy on one branch only. If the user wants both, run two sequential flows with two confirmation gates.
Each mechanic owns its own Critical Rules. Once routed, follow the branch's rules — do not relax them from this top level.
Never apply, restore, or remove compliance settings without user confirmation. For apply: run posture analysis first, show the plan (summary + detail). In every case: ask, then END YOUR REPLY — never run the mutating command in the same response as the confirmation question. Proceed only on an explicit
```
y
```
in the user's next message. The user's original request is intent, not consent. Sole exception: the user explicitly waived confirmation in advance (e.g., "don't ask for confirmation") — treat the waiver as
```
y
```
.
Always show a receipt after any apply. Present the post-apply report (settings configured, manual steps needed, Applied by / date) so the user has a record. No local file write is needed — the CLI and UiPath platform are the source of truth.
Compliance Standards is a preview feature — gate every compliance-pack flow. Append the preview disclaimer to user-facing compliance-standard responses, and on any
```
uip gov compliance-packs …
```
call returning HTTP 403 / Forbidden, stop immediately (do not retry, run no further compliance commands) and tell the user the feature requires enrolling in the preview program. Exact wording + placement in
```
references/compliance-pack/preview-gate.md
```
. A 403 is preview-not-enabled; a 401 is a normal login failure — do NOT conflate them.
Always
uip login
before any
uip gov …
command.
```
evaluate
```
(Access) additionally requires tenant-scoped login — see
```
access-policy-overview-guide.md
```
§ Critical Rules
.
Never fabricate UUIDs. Resolve every named user / group / process / agent / flow / robot / tenant via the relevant branch's lookups.

先分类再创作。处理任何治理请求的第一步是将意图分类为分支A（AOps）或分支B（访问策略）。参考
```
references/disambiguation-guide.md
```
中的优先级规则。在分类确定前，绝不能启动
```
create
```
/
```
update
```
/
```
delete
```
操作——分类可通过用户表述或歧义消除问题完成。
分类处于顶层。机制库默认分支已选定。不要让这些流程询问“你是否指另一个分支？”——该问题应在本顶层流程中提出。
单次变更仅对应一个分支。单个用户请求仅生成一个分支的策略。如果用户需要两个分支的策略，需运行两个连续流程并分别确认。
每个机制自有核心规则。路由到分支后，需遵循该分支的规则——不得在顶层放宽规则。
未经用户确认，绝不能应用、恢复或移除合规设置。应用前：先运行状态分析，展示计划（摘要+详情）。任何情况下：先询问，然后结束回复——绝不能在同一回复中同时发送确认问题和变更命令。仅在用户下一条消息明确回复
```
y
```
时才可继续。用户的原始请求是意图，而非同意。唯一例外：用户明确提前豁免确认（例如“不要询问确认”）——将豁免视为
```
y
```
。
任何应用操作后均需展示回执。呈现应用后的报告（已配置的设置、需手动完成的步骤、应用者/日期），以便用户留存记录。无需写入本地文件——CLI和UiPath平台为可信数据源。
合规标准为预览功能——所有合规包流程需设置准入门槛。在面向用户的合规标准回复中附加预览免责声明，且当任何
```
uip gov compliance-packs …
```
调用返回HTTP 403 / 禁止访问时，立即停止（不要重试，不要运行后续合规命令），并告知用户该功能需要注册预览计划。具体措辞和位置参考
```
references/compliance-pack/preview-gate.md
```
。403表示未启用预览；401表示普通登录失败——请勿混淆两者。
执行任何
uip gov …
命令前，必须先
uip login
。访问策略的
```
evaluate
```
操作还需租户范围的登录——参考
```
access-policy-overview-guide.md
```
§ 核心规则
。
绝不能编造UUID。需通过对应分支的查询功能解析所有命名的用户/组/流程/Agent/Flow/Robot/租户。

Workflow

工作流程

Classify the intent silently — never announce routing to the user. Internal flow labels (AOps / Access / Compliance standard) are implementation details; the user sees only the outcome. Read
```
references/disambiguation-guide.md
```
— it lists the strong signals for each flow, the phrase patterns that need disambiguation, and the canonical worked example. If a strong signal matches, route silently. If the phrasing is ambiguous (matches AOps or Access), ask the disambiguation question and wait for a digit reply. If the user replies with anything other than
```
1
```
or
```
2
```
, treat it as a re-statement of intent and re-classify. Do not run any CLI command before classification is settled — the disambiguation question itself does not need
```
uip
```
, and an unrelated request (platform ops, agent authoring) must redirect to a sibling skill before any setup happens here. If the request contains a standard name (
```
ISO 42001
```
),
```
apply standard
```
,
```
compliance posture
```
,
```
drift check
```
,
```
am I compliant
```
,
```
is my tenant compliant
```
,
```
what packs are available
```
,
```
what packs are configured
```
,
```
which standards are enabled
```
,
```
organization-wide
```
,
```
disable standard
```
, or
```
reset
```
/
```
restore
```
/
```
undo drift on a standard
```
→ route silently to the appropriate compliance standard plugin. Read
```
partial-apply/planning.md
```
for scoped requests;
```
coverage/impl.md
```
for posture checks;
```
catalog/impl.md
```
for discovery;
```
query/impl.md
```
for information queries;
```
full-apply/impl.md
```
after confirming the posture plan;
```
disable/impl.md
```
for removal;
```
restore/impl.md
```
for resetting a configured standard back to its recommended settings;
```
catalog/impl.md
```
+
```
state list
```
for listing currently configured packs.
Verify
uip
and login (only after classification routes to a governance flow).
bash
```
which uip && uip --version
uip login status --output json
```
If not installed:
```
npm install -g @uipath/cli
```
. If not logged in:
```
uip login
```
(
```
--authority <URL>
```
for non-prod). For Access
```
evaluate
```
, login MUST be tenant-scoped. If logged in to the wrong tenant within the same org — use the fast path:
```
uip login tenant list --output json
```
then
```
uip login tenant set <NAME>
```
. Full re-login only needed for a different org or authority. See
```
references/auth-context.md
```
§ Switching tenants.
Route to the chosen mechanic and follow its flow end-to-end.
- AOps product policy →
```
references/aops-policy/aops-policy-overview-guide.md
```
- Access ToolUsePolicy →
```
references/access-policy/access-policy-overview-guide.md
```
- Compliance standard → use plugin routing from step 1 above (catalog / coverage / full-apply / partial-apply / disable / restore / query)

静默分类意图——绝不向用户宣布路由。内部流程标签（AOps / 访问策略 / 合规标准）为实现细节；用户仅需看到结果。阅读
```
references/disambiguation-guide.md
```
——其中列出了各流程的强信号、需要消除歧义的短语模式以及典型示例。如果匹配强信号，直接静默路由。如果表述存在歧义（同时匹配AOps或访问策略），提出歧义消除问题并等待数字回复。如果用户回复非
```
1
```
或
```
2
```
，将其视为意图重述并重新分类。分类确定前，绝不能运行任何CLI命令——歧义消除问题本身无需
```
uip
```
，而无关请求（平台运维、Agent创作）必须在任何设置前重定向到兄弟技能。如果请求包含标准名称（
```
ISO 42001
```
）、
```
apply standard
```
、
```
compliance posture
```
、
```
drift check
```
、
```
am I compliant
```
、
```
is my tenant compliant
```
、
```
what packs are available
```
、
```
what packs are configured
```
、
```
which standards are enabled
```
、
```
organization-wide
```
、
```
disable standard
```
或
```
reset
```
/
```
restore
```
/
```
undo drift on a standard
```
→ 静默路由到相应的合规标准插件。范围请求参考
```
partial-apply/planning.md
```
；状态检查参考
```
coverage/impl.md
```
；发现功能参考
```
catalog/impl.md
```
；信息查询参考
```
query/impl.md
```
；确认状态计划后参考
```
full-apply/impl.md
```
；移除操作参考
```
disable/impl.md
```
；重置已配置标准为推荐设置参考
```
restore/impl.md
```
；列出当前已配置包参考
```
catalog/impl.md
```
+
```
state list
```
。
验证
uip
和登录状态（仅在分类路由到治理流程后执行）。
bash
```
which uip && uip --version
uip login status --output json
```
若未安装：
```
npm install -g @uipath/cli
```
。若未登录：
```
uip login
```
（非生产环境使用
```
--authority <URL>
```
）。访问策略的
```
evaluate
```
操作必须使用租户范围登录。若在同一组织内登录到错误租户——使用快速路径：
```
uip login tenant list --output json
```
然后
```
uip login tenant set <NAME>
```
。仅在切换到不同组织或权限时才需完全重新登录。参考
```
references/auth-context.md
```
§ 切换租户。
路由到选定的机制并全程遵循其流程。
- AOps产品策略 →
```
references/aops-policy/aops-policy-overview-guide.md
```
- 访问工具使用策略 →
```
references/access-policy/access-policy-overview-guide.md
```
- 合规标准 → 使用步骤1中的插件路由（catalog / coverage / full-apply / partial-apply / disable / restore / query）

Disambiguation Question

歧义消除问题

When the user's intent fits both branches, render exactly this numbered list (no

AskUserQuestion

, no table) and wait for a digit reply:

markdown

undefined

当用户意图同时符合两个分支时，严格呈现以下编号列表（不使用

AskUserQuestion

，不使用表格）并等待数字回复：

markdown

undefined

Which layer should this rule govern?

该规则应管控哪一层？

Govern the product — control what Studio / StudioX / Assistant / Robot / AI Trust Layer / Agent Builder can do (e.g. block ChatGPT inside Studio, enforce Workflow Analyzer, disable a Marketplace widget). Backed by
```
uip gov aops-policy
```
.
Govern resource/tool use — control which Actor Processes / identities can invoke which child Resource as a tool (e.g. block agents tagged
```
Sandbox
```
from being called, only let the finance group trigger this Flow). Backed by
```
uip gov access-policy
```
.

Reply with the number.


The canonical ambiguous prompt is *"Block ChatGPT for my finance team using Studio."* See [`references/disambiguation-guide.md`](./references/disambiguation-guide.md#worked-example--the-canonical-ambiguous-prompt) for the worked-out reasoning of why both interpretations produce a working but different artifact.

管控产品——控制Studio / StudioX / Assistant / Robot / AI Trust Layer / Agent Builder 可执行的操作（例如：阻止Studio内的ChatGPT、强制执行Workflow Analyzer、禁用Marketplace组件）。基于
```
uip gov aops-policy
```
实现。
管控资源/工具使用——控制哪些参与者流程/身份可以调用哪些子资源作为工具（例如：阻止标记为
```
Sandbox
```
的Agent被调用、仅允许财务组触发该Flow）。基于
```
uip gov access-policy
```
实现。

请回复对应数字。


典型的歧义示例是*"Block ChatGPT for my finance team using Studio."*。参考[`references/disambiguation-guide.md`](./references/disambiguation-guide.md#worked-example--the-canonical-ambiguous-prompt)了解两种解释为何会生成有效但不同的产物。

Reference Navigation

参考导航

I need to...	Read
Decide which branch a request belongs to (priors, phrase tables, worked example)	`references/disambiguation-guide.md`
Author an AOps product policy	`references/aops-policy/aops-policy-overview-guide.md`
Deploy an AOps policy to user / group / tenant	`references/aops-policy/aops-policy-deploy-guide.md`
Query the deployed AOps policy / effective rules	`references/aops-policy/aops-policy-deployed-guide.md`
Author an Access ToolUsePolicy	`references/access-policy/access-policy-overview-guide.md`
Look up CLI flags / output shapes (AOps)	`references/aops-policy/aops-policy-commands.md`
Look up CLI flags / output shapes (Access)	`references/access-policy/access-policy-commands.md`
Resolve a name to a UUID for Access	`references/access-policy/resource-lookup-guide.md`
Diagnose a governance failure (capability index)	`references/diagnose/CAPABILITY.md`
Recognize a known governance failure pattern	`references/diagnose/references/failure-modes.md`
Walk the diagnostic priority ladder	`references/diagnose/references/troubleshooting-guide.md`
Discover available compliance standards	`references/compliance-pack/catalog/impl.md`
List which compliance standards are currently configured	`references/compliance-pack/catalog/impl.md` — use `state list tenant <id>`
Posture analysis — what settings are configured vs recommended	`references/compliance-pack/coverage/impl.md`
Apply full compliance pack	Run coverage first, then `references/compliance-pack/full-apply/impl.md`
Apply specific controls / clauses	`references/compliance-pack/partial-apply/planning.md`
Remove compliance standard settings	`references/compliance-pack/disable/impl.md`
Reset / restore a standard to its recommended settings (undo drift)	`references/compliance-pack/restore/impl.md`
Query — what does a clause / control recommend?	`uip gov compliance-packs catalog get <packId> --output json` (e.g. `iso-42001-2023` ), then `references/compliance-pack/query/impl.md`
Preview disclaimer + 403 opt-in gate (all compliance flows)	`references/compliance-pack/preview-gate.md`

我需要...	阅读文档
确定请求所属分支（优先级、短语表、典型示例）	`references/disambiguation-guide.md`
创作AOps产品策略	`references/aops-policy/aops-policy-overview-guide.md`
将AOps策略部署到用户/组/租户	`references/aops-policy/aops-policy-deploy-guide.md`
查询已部署的AOps策略/有效规则	`references/aops-policy/aops-policy-deployed-guide.md`
创作访问工具使用策略	`references/access-policy/access-policy-overview-guide.md`
查询CLI参数/输出格式（AOps）	`references/aops-policy/aops-policy-commands.md`
查询CLI参数/输出格式（访问策略）	`references/access-policy/access-policy-commands.md`
为访问策略将名称解析为UUID	`references/access-policy/resource-lookup-guide.md`
诊断治理失败（能力索引）	`references/diagnose/CAPABILITY.md`
识别已知的治理失败模式	`references/diagnose/references/failure-modes.md`
按照诊断优先级排查问题	`references/diagnose/references/troubleshooting-guide.md`
发现可用的合规标准	`references/compliance-pack/catalog/impl.md`
列出当前已配置的合规标准	`references/compliance-pack/catalog/impl.md` — 使用 `state list tenant <id>`
状态分析——已配置设置与推荐设置对比	`references/compliance-pack/coverage/impl.md`
应用完整合规包	先运行状态分析，再参考 `references/compliance-pack/full-apply/impl.md`
应用特定控制/条款	`references/compliance-pack/partial-apply/planning.md`
移除合规标准设置	`references/compliance-pack/disable/impl.md`
重置/恢复标准为推荐设置（消除偏差）	`references/compliance-pack/restore/impl.md`
查询——某条款/控制的推荐内容是什么？	`uip gov compliance-packs catalog get <packId> --output json` （例如 `iso-42001-2023` ），再参考 `references/compliance-pack/query/impl.md`
预览免责声明 + 403准入门槛（所有合规流程）	`references/compliance-pack/preview-gate.md`

Anti-patterns

反模式

Do NOT skip the disambiguation question when the phrasing fits both branches. Mechanic libraries assume the branch is chosen and will not catch wrong-branch routing.
Do NOT hand off to a mechanic, then ask "did you mean the other branch?". That question must happen at this top level.
Do NOT merge AOps and Access intent into one policy. Different artifacts, different CLIs, different schemas.
Do NOT activate this skill for platform ops. Route to
```
uipath-platform
```
.
Do NOT propose skill edits when intent doesn't map to either branch. Ask the user to clarify.
Do NOT use
```
deployed-policy list
```
for gap detection — it returns all rules in priority order, not the merged effective value. Use
```
deployed-policy get <licenseType> <productName> <tenantId>
```
to get the single effective merged policy.
Do NOT skip the post-apply report even if apply partially fails — show what succeeded and what needs manual attention.
For compliance pack posture analysis, use
```
uip gov compliance-packs state coverage
```
— do NOT use
```
aops-policy deployed-policy
```
commands; those are for AOps policy debugging (Branch A), not compliance pack flows.
For full pack configuration, use
```
state enable
```
— do NOT manually call
```
aops-policy create
```
for each product; that path is only for partial/scoped configuration.
For partial/scoped configuration (specific clauses, products, or areas only), use
```
synthesize-formdata.mjs
```
+
```
aops-policy create
```
— do NOT call
```
state enable
```
;
```
state enable
```
applies the FULL standard and cannot be scoped to specific clauses or products.
For org-wide apply, do NOT call
```
state enable organization
```
— the backend does not implement org-scope enable. Instead: list tenants with
```
uip login tenant list
```
, then call
```
state enable tenant <id>
```
for each tenant individually. See
```
references/compliance-pack/full-apply/impl.md
```
§ Org-scope deployment.
NEVER claim a tenant is "compliant" with a standard — only that recommended settings are configured. Compliance status is determined by the customer's auditor.
Do NOT surface policy names, product identifiers (AITrustLayer, Robot, Development), or clause IDs (A.6.2.8) as the main response unit — lead with plain-English control names and clause descriptions. Policy is an internal implementation detail. Clause IDs appear only as secondary reference in parentheses.
Do NOT use the word "controls" in user-facing output — use "settings". The UiPath UI uses "settings" for what the standard recommends be configured.
Do NOT narrate internal steps to the user. Never say "I ran…", "The CLI returned…", "Calling the governance CLI…", or "The API responded with…". Run commands silently and present only the interpreted result using the output templates in the reference docs. Raw JSON, UUIDs, error stacks, and CLI output are never shown — summarise errors in plain English.
Do NOT dump raw command output. Parse every CLI response and render it as a formatted table or plain-English summary. The user sees the outcome, never the mechanism.

当表述同时符合两个分支时，绝不能跳过歧义消除问题。机制库默认分支已选定，无法捕获错误分支路由。
绝不能先移交到机制，再询问“你是否指另一个分支？”。该问题必须在顶层流程中提出。
绝不能将AOps和访问策略意图合并为一个策略。两者是不同的产物、不同的CLI、不同的 schema。
绝不能为平台运维激活本技能。应重定向到
```
uipath-platform
```
。
当意图无法匹配任何分支时，绝不能提议修改技能。应请用户澄清。
绝不能使用
```
deployed-policy list
```
进行差距检测——它按优先级返回所有规则，而非合并后的有效值。使用
```
deployed-policy get <licenseType> <productName> <tenantId>
```
获取单一的合并后有效策略。
即使应用部分失败，也绝不能跳过应用后的报告——需展示成功部分和需手动处理的部分。
合规包状态分析需使用
```
uip gov compliance-packs state coverage
```
——绝不能使用
```
aops-policy deployed-policy
```
命令；这些命令仅用于AOps策略调试（分支A），而非合规包流程。
完整包配置需使用
```
state enable
```
——绝不能为每个产品手动调用
```
aops-policy create
```
；该路径仅用于部分/范围配置。
部分/范围配置（仅特定条款、产品或领域）需使用
```
synthesize-formdata.mjs
```
+
```
aops-policy create
```
——绝不能调用
```
state enable
```
；
```
state enable
```
会应用完整标准，无法限定到特定条款或产品。
全组织范围应用时，绝不能调用
```
state enable organization
```
——后端未实现组织范围启用功能。应使用
```
uip login tenant list
```
列出租户，然后为每个租户单独调用
```
state enable tenant <id>
```
。参考
```
references/compliance-pack/full-apply/impl.md
```
§ 组织范围部署。
绝不能声称租户“符合”某标准——只能说明已配置推荐设置。合规状态由客户的审计师确定。
绝不能将策略名称、产品标识符（AITrustLayer、Robot、Development）或条款ID（A.6.2.8）作为主要回复单元——应先以通俗易懂的控制名称和条款描述开头。策略是内部实现细节。条款ID仅作为次要参考放在括号中。
用户输出中绝不能使用“controls”一词——使用“settings”。UiPath UI中用“settings”指代标准推荐配置的内容。
绝不能向用户叙述内部步骤。永远不要说“我运行了…”、“CLI返回了…”、“正在调用治理CLI…”或“API响应为…”。静默运行命令，仅使用参考文档中的输出模板呈现解释后的结果。绝不能展示原始JSON、UUID、错误堆栈或CLI输出——需用通俗易懂的语言总结错误。
绝不能直接输出原始命令结果。需解析每个CLI响应并格式化为表格或通俗易懂的摘要。用户仅需看到结果，无需了解机制。