diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 60d16270b1..911d5803d4 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -42,6 +42,7 @@ jobs:
         - Any YAML file in `data/*/*.yaml` subdirectories (CLI reference data generated from upstream)
           - Examples: `data/engine-cli/*.yaml`, `data/buildx/*.yaml`, `data/scout-cli/*.yaml`
           - Exception: root-level data/ files are manually maintained (allow edits)
+        - `content/reference/api/ai-governance/api.yaml` (verbatim copy of the upstream OpenAPI spec, vendored from the private docker/governor-services repo via `hack/sync-governance-api.sh`)
 
         ### 2. Missing Redirects When Removing/Moving Pages (HIGH)
         When a PR removes or moves a page:
diff --git a/AGENTS.md b/AGENTS.md
index a315461cd2..4280af7bf7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -45,10 +45,16 @@ must go to the source repository:
 | Model Runner reference | docker/model-runner |
 | Dockerfile reference | moby/buildkit |
 | Engine API reference | moby/moby |
+| AI Governance API (`content/reference/api/ai-governance/api.yaml`) | docker/governor-services (private) |
 
 If a validation failure or broken link traces back to vendored content, note
 the upstream repo that needs fixing. Do not attempt to fix it locally.
 
+`content/reference/api/ai-governance/api.yaml` is a verbatim copy of the
+upstream `openapi.yaml` — do not edit it by hand. Re-vendor it with
+`hack/sync-governance-api.sh`, which fetches the latest spec from the private
+`docker/governor-services` repo (using your own `gh` auth).
+
 ## Writing guidelines
 
 Read and follow [STYLE.md](STYLE.md) and [COMPONENTS.md](COMPONENTS.md).