Compliance

Control mapping populated from live system state, not from a questionnaire.

bash
curl -s $CP/v1/admin/compliance -H "Authorization: Bearer $KEY"

Requires compliance:read, held by SECURITY_ADMIN, AUDITOR, ADMIN and OWNER.

The mapping is populated from live state

A control does not claim to be satisfied because somebody ticked a box. It claims to be satisfied because the system can produce the evidence, right now, from its own records.

A questionnaire answer and a query result are very different kinds of claim, and only one of them is still true next quarter.

#What Veefore can evidence

These are claims the system can substantiate from its own data.

#Access control

Claim	Evidence
Access is role-based and least-privilege	The role and permission model, and which principals hold what
High-impact operations need explicit grants	`HIGH_IMPACT_PERMISSIONS` cannot come from a wildcard
Irreversible operations need re-authentication	`STEP_UP_PERMISSIONS`, and a step-up audit event paired with every use
Access is removed on offboarding	SCIM deprovisioning records
Privileged access is reviewed	Role grants, with an audit trail of changes
Emergency access is controlled and reviewed	Break-glass grants and every use, at `CRITICAL` severity

#Authentication

Claim	Evidence
Non-human actors have unique identities	One Ed25519 key pair per agent
Credentials expire	Session, step-up, agent token and passport TTLs
Credentials are rotated	Rotation events, with timestamps
Revocation is immediate and terminal	Revocation events; `REVOKED` is a terminal state
MFA is enforced	SSO configuration, plus the `doctor` finding when it is not

#Change management

Claim	Evidence
Authorization changes are versioned	Policy versions are immutable once activated
Changes are tested before release	Activation refuses while any test case fails
Changes are approved	Activation requires step-up and a recorded reason
Changes can be reverted	Rollback creates a new version with the old content; history stays linear
Changes are attributable	Every activation names the actor, the version, the reason and the time

#Monitoring

Claim	Evidence
Activity is logged	An action record per protected action, with complete lineage
Logs are tamper-evident	Keyed hash chain, with localised break detection
Logs are retained	Configurable retention; shortening it is step-up gated and `CRITICAL`
Anomalies are detected	Thirteen named risk signals, each with an explanation
Incidents are tracked	Incident records with linked actions and audit events

#Data protection

Claim	Evidence
Secrets are encrypted at rest	Credential material sealed with `VEEFORE_DATA_ENCRYPTION_KEY`
Secrets are not exposed	No endpoint returns material; redaction applied on ingest
Tenants are isolated	Application-level scope guard plus PostgreSQL RLS
Data access is logged	Audit events, including export with a required reason
Sensitive fields can be masked	The `MASK` decision, redacting in the forwarded request and in audit

#What Veefore cannot evidence

Being clear about this is more useful than implying coverage.

Your own application's controls. Veefore evidences what agents were permitted to do. It knows nothing about the rest of your system.

Physical and infrastructure controls. Data centre access, device management, network segmentation outside Veefore.

Organizational controls. Training, background checks, vendor management, business continuity.

Your downstream's controls. Veefore brokering a credential says nothing about what happens on the other side of the call.

A control mapping is not a certification

Veefore produces evidence for controls in its own scope. An audit covers your whole organization, and Veefore is one system within it.

Use the mapping to answer the questions it can answer, with real data. Do not present it as an attestation of anything wider.

#Produce an evidence pack

bash
veefore audit export \
  --format csv \
  --from 2026-07-01T00:00:00Z \
  --to 2026-10-01T00:00:00Z \
  --reason "Q3 2026 SOC 2 Type II evidence" \
  --out audit-2026-q3.csv

Watermarked and hashed. Send the hash separately from the file — it proves nothing if it travelled with the file.

Alongside it:

bash
veefore audit verify                 # chain integrity, dated
veefore doctor --strict              # posture at the time of the pack
curl -s $CP/v1/admin/compliance …        # the control mapping

Four artefacts: the events, a proof the events are intact, the posture, and the mapping. That is a defensible package.

#Questions auditors actually ask

"How do you prevent an AI agent from exceeding its authority?"

Bounded delegations that can never exceed their parent, deterministic policy evaluated on every action, and a complete lineage for each decision. Show an action record — it names the policy, the version, the rule, the conditions and the resolved authority.

"What stops an agent from using a credential it should not have?"

The agent holds no credentials. It receives short-lived, scoped leases issued only after an action is permitted. Show the credential metadata — no material is retrievable through any API.

"How do you know the logs have not been altered?"

A keyed hash chain, verified on a schedule, with break detection localised to a position. Show a dated verification run.

"What happens when the system is unavailable?"

Protected actions are refused. Show tests/chaos — 13 cases asserting fail-closed behaviour and recovery.

"Who can change the authorization rules, and is it reviewed?"

policy:activate is high-impact and step-up gated, and activation requires a reason and passing tests. Show the version history with actors and reasons.

"How do you handle a compromised agent?"

Show the runbook and an emergency control record with its blast radius — which is recomputed at execution time and stored.

#Continuous, not periodic

The reason to use the live mapping rather than a spreadsheet: it stops being true on its own when something drifts. A control that depended on trust evidence which has since expired reports as unsatisfied, without anyone noticing a gap at the wrong moment.

Add it to your weekly review:

bash
veefore doctor --strict
veefore audit verify
curl -s $CP/v1/admin/compliance -H "Authorization: Bearer $KEY"

Audit integrity

What the chain proves.

Audit and export

Producing a verifiable pack.

RBAC

The access control story.

Testing strategy

The suites that back the claims.