> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Governance mode

A version locked in Governance mode cannot be overwritten or deleted until its retain-until date, with one exception: the account owner can still delete it on purpose. This makes Governance the safe choice for backups and for trying out Object Lock.

To set a Governance lock, choose **Governance** as the mode in a [default retention](/buckets/object-lock/overview#set-a-default-retention), when you [lock existing versions](/buckets/object-lock/overview#lock-existing-versions) or when you [lock one version](/buckets/object-lock/overview#lock-or-change-one-version).

## What you can and cannot do

| Action                                            | Allowed?                                                     |
| ------------------------------------------------- | ------------------------------------------------------------ |
| Download the version                              | Yes                                                          |
| Overwrite the file                                | Yes, but it creates a new version. The locked version stays. |
| Make the lock longer                              | Yes                                                          |
| Change the version to Compliance                  | Yes. This cannot be undone.                                  |
| Make the lock shorter or remove it in the console | No                                                           |
| Delete the version before the date                | Only the account owner, after confirming. Sub-users cannot.  |

## Delete a Governance-locked version

Signed in as the account owner:

#### Find the version

Open the bucket and turn on **Show Versions**.

#### Delete it

Open the version's **⋮** menu and select **Delete**. The window **Governance Lock Active** shows when the lock would end.

#### Confirm

Type `CONFIRM` and select **Delete Version**. The version is deleted for good.

![The Governance Lock Active window with the retention end date, the CONFIRM field and the Delete Version button](/_fern-img/e38a5c28b1fa37a1a33bd022d80b44839d05295363af7217b584d72bc3088034.webp)

## Change a version to Compliance

In the version's **Lock Settings**, select **Edit** under **Retention**, choose **Compliance** and enter at least as many days as are left. Select **Save Retention** and confirm. After this, nobody can delete the version or shorten its lock until the date passes: see [Compliance mode](/buckets/object-lock/compliance-mode).

![Editing a version's retention with the mode changed to Compliance and the Save Retention button](/_fern-img/20693cce511787e838beb82f31ad114bfefe5246a053c0265f0d4fdb50bb1956.webp)

## Lock a file with the AWS CLI

```bash
aws s3api put-object-retention --bucket my-locked-bucket --key myfile.txt \
  --retention "Mode=GOVERNANCE,RetainUntilDate=2026-12-31T00:00:00Z" --profile zata
```

This locks the newest version of `myfile.txt` until the date you give. Use a sub-user key only if the owner has given it the Object Lock permissions; otherwise Zata answers `AccessDenied`.