Governing skills, prompts and secrets without slowing teams down

Governance fails when it means asking permission to try anything. It also fails when everything is public by default. Joyst takes a middle path. Specialists can write freely in draft, while publishing, visibility and group permissions decide what reaches the wider organisation.

Skills and prompts need drafts and publishing

Editing a live skill without a draft state is how broken guidance spreads. Version history and rollback are not luxuries for regulated teams. They are how you keep improving without gambling on every change.

Secrets stay private unless you share

API keys should not live in chat logs. The vault is private by default, with deliberate sharing across the organisation and substitution on the server for agents. When Joyst calls an HTTP API for you, it fills the secret on the server and removes it from the response. That is the only substitution.

Permissions for groups, not for everyone

Finance MCPs and client-specific skills should not be open to everyone in Slack. Permissions granted to groups, with folder inheritance and the option to set a group's access to None, match how agencies and product teams already think about access.

See how this works in AI governance, or sign up to try the catalogue. For a step-by-step checklist, read a practical AI governance framework.