Plugin governance

Architecture - in development

Managed-mode plugin governance is part of the Viewer's design. The policy controls below describe how organizations are intended to lock down and provision plugins; not every control is generally available yet.

In managed mode, an organization - not the individual user - decides which plugins exist in the Viewer, what they may do, and whether the user can change any of it. Policy is delivered with the authenticated session (see Authentication) and enforced by the same fail-closed core that verifies documents.

Policy controls

Policy control	Behavior in the Viewer
Allowlist	Only plugins on the org list may load; everything else is blocked even if validly signed.
Denylist	Named plugins (or publishers) are blocked regardless of user action or local presence.
Mandated (required) plugins	Org-required plugins are auto-provisioned and kept current - e.g. DLP, watermarking, classification banners.
Locked install/remove	Users cannot add or remove plugins; only org policy changes the set.
Capability scoping	The org narrows declared permissions further - e.g. revoke `network.fetch`, restrict `file.read` to the active document.
Version pinning / freshness	Pin an approved version or require auto-update; stale versions are blocked from loading.
Revocation	A centrally revoked plugin is pulled everywhere; the Viewer fails closed on it fleet-wide.

Capability scoping is strictly subtractive: org policy can only remove or constrain what a plugin's signed manifest already requested, never grant more.

Mandated plugins

Required plugins let an organization guarantee controls travel with every session. Because they are auto-provisioned and can hold the policy.enforce capability (managed mode only), they can apply controls such as watermarking or DLP over rendering - and because install/remove is locked, a user cannot disable them to bypass policy.

Lockdown summary

Users get the plugins the org provisions - no more, no less.
Users cannot install, remove, downgrade, or re-permission plugins.
Capabilities are bounded by the intersection of the plugin's signed manifest and the org policy.
Policy arrives with the authenticated session and updates as policy changes.

Integrity guarantees under governance

Governance does not replace verification - it composes with it. Under managed mode the Viewer still verifies every document, every plugin, and its own binary, and fails closed on any mandatory failure. Policy decides which plugins and capabilities are allowed; the integrity core decides whether what loaded is authentic and untampered. See Integrity.

Enterprise and government relevance

Managed-mode governance is aimed at regulated and high-assurance environments where unsanctioned extensions are unacceptable and mandated controls (DLP, watermarking, classification handling) must be guaranteed. See the government solution and the security overview for how these controls fit the broader trust model.