--- title: Compliance description: Control mapping populated from live system state, not from a questionnaire. --- ```bash curl -s $CP/v1/admin/compliance -H "Authorization: Bearer $KEY" ``` Requires `compliance:read`, held by `SECURITY_ADMIN`, `AUDITOR`, `ADMIN` and `OWNER`. :::security The mapping is populated from live state A control does not claim to be satisfied because somebody ticked a box. It claims to be satisfied because the system can produce the evidence, right now, from its own records. A questionnaire answer and a query result are very different kinds of claim, and only one of them is still true next quarter. ::: ## What Veefore can evidence These are claims the system can substantiate from its own data. ### Access control | Claim | Evidence | | --- | --- | | Access is role-based and least-privilege | The role and permission model, and which principals hold what | | High-impact operations need explicit grants | `HIGH_IMPACT_PERMISSIONS` cannot come from a wildcard | | Irreversible operations need re-authentication | `STEP_UP_PERMISSIONS`, and a step-up audit event paired with every use | | Access is removed on offboarding | SCIM deprovisioning records | | Privileged access is reviewed | Role grants, with an audit trail of changes | | Emergency access is controlled and reviewed | Break-glass grants and every use, at `CRITICAL` severity | ### Authentication | Claim | Evidence | | --- | --- | | Non-human actors have unique identities | One Ed25519 key pair per agent | | Credentials expire | Session, step-up, agent token and passport TTLs | | Credentials are rotated | Rotation events, with timestamps | | Revocation is immediate and terminal | Revocation events; `REVOKED` is a terminal state | | MFA is enforced | SSO configuration, plus the `doctor` finding when it is not | ### Change management | Claim | Evidence | | --- | --- | | Authorization changes are versioned | Policy versions are immutable once activated | | Changes are tested before release | Activation refuses while any test case fails | | Changes are approved | Activation requires step-up and a recorded reason | | Changes can be reverted | Rollback creates a new version with the old content; history stays linear | | Changes are attributable | Every activation names the actor, the version, the reason and the time | ### Monitoring | Claim | Evidence | | --- | --- | | Activity is logged | An action record per protected action, with complete lineage | | Logs are tamper-evident | Keyed hash chain, with localised break detection | | Logs are retained | Configurable retention; shortening it is step-up gated and `CRITICAL` | | Anomalies are detected | Thirteen named risk signals, each with an explanation | | Incidents are tracked | Incident records with linked actions and audit events | ### Data protection | Claim | Evidence | | --- | --- | | Secrets are encrypted at rest | Credential material sealed with `VEEFORE_DATA_ENCRYPTION_KEY` | | Secrets are not exposed | No endpoint returns material; redaction applied on ingest | | Tenants are isolated | Application-level scope guard plus PostgreSQL RLS | | Data access is logged | Audit events, including export with a required reason | | Sensitive fields can be masked | The `MASK` decision, redacting in the forwarded request and in audit | ## What Veefore cannot evidence Being clear about this is more useful than implying coverage. **Your own application's controls.** Veefore evidences what agents were permitted to do. It knows nothing about the rest of your system. **Physical and infrastructure controls.** Data centre access, device management, network segmentation outside Veefore. **Organizational controls.** Training, background checks, vendor management, business continuity. **Your downstream's controls.** Veefore brokering a credential says nothing about what happens on the other side of the call. :::warning A control mapping is not a certification Veefore produces evidence for controls in its own scope. An audit covers your whole organization, and Veefore is one system within it. Use the mapping to answer the questions it can answer, with real data. Do not present it as an attestation of anything wider. ::: ## Produce an evidence pack ```bash veefore audit export \ --format csv \ --from 2026-07-01T00:00:00Z \ --to 2026-10-01T00:00:00Z \ --reason "Q3 2026 SOC 2 Type II evidence" \ --out audit-2026-q3.csv ``` Watermarked and hashed. Send the hash separately from the file — it proves nothing if it travelled with the file. Alongside it: ```bash veefore audit verify # chain integrity, dated veefore doctor --strict # posture at the time of the pack curl -s $CP/v1/admin/compliance … # the control mapping ``` Four artefacts: the events, a proof the events are intact, the posture, and the mapping. That is a defensible package. ## Questions auditors actually ask **"How do you prevent an AI agent from exceeding its authority?"** Bounded delegations that can never exceed their parent, deterministic policy evaluated on every action, and a complete lineage for each decision. Show an action record — it names the policy, the version, the rule, the conditions and the resolved authority. **"What stops an agent from using a credential it should not have?"** The agent holds no credentials. It receives short-lived, scoped leases issued only after an action is permitted. Show the credential metadata — no material is retrievable through any API. **"How do you know the logs have not been altered?"** A keyed hash chain, verified on a schedule, with break detection localised to a position. Show a dated verification run. **"What happens when the system is unavailable?"** Protected actions are refused. Show [`tests/chaos`](/architecture/testing-strategy) — 13 cases asserting fail-closed behaviour and recovery. **"Who can change the authorization rules, and is it reviewed?"** `policy:activate` is high-impact and step-up gated, and activation requires a reason and passing tests. Show the version history with actors and reasons. **"How do you handle a compromised agent?"** Show the [runbook](/operate/runbook-compromised-agent) and an emergency control record with its blast radius — which is recomputed at execution time and stored. ## Continuous, not periodic The reason to use the live mapping rather than a spreadsheet: it stops being true on its own when something drifts. A control that depended on trust evidence which has since expired reports as unsatisfied, without anyone noticing a gap at the wrong moment. Add it to your weekly review: ```bash veefore doctor --strict veefore audit verify curl -s $CP/v1/admin/compliance -H "Authorization: Bearer $KEY" ``` ## Related :::cards :::card Audit integrity | /secure/audit-integrity What the chain proves. ::: :::card Audit and export | /operate/audit-and-export Producing a verifiable pack. ::: :::card RBAC | /secure/rbac The access control story. ::: :::card Testing strategy | /architecture/testing-strategy The suites that back the claims. ::: :::