GovOps Working Group

The GovOps Working Group will develop a new scalable operational architecture for governing authorization risk across modern software systems, infrastructure, and endpoints. GovOps elevates “capability” as the primary unit of governance for measuring, managing, and reducing authorization risk. The group’s initial work will define a standard catalog of capabilities, new metrics to measure the direction of travel, and an architecture overview with implementation and governance guidance. By exposing capabilities, governors can deploy new tools to help prioritize mitigating the authorization risks with the biggest impacts, hold the right parties accountable, and foster organizational risk transparency. This work supports OWASP’s mission by advancing software security in an area that is becoming increasingly urgent: authorization governance. As AI agents and autonomous workloads expand, organizations need open, vendor-neutral methods to make access decisions visible, measurable, and accountable. GovOps will help OWASP provide leadership in securing the next generation of application, API, and agentic systems.