Trust & Governance

RBAC, audit logs, model policy, and compliance evidence — the enterprise trust layer

Controls Passing

Controls Failing

Not Tested

Blocked Events (24h)

RBAC Role Management

Role	Description	Permissions	Users	Tenant
Platform Admin	Full platform administration — all tenants and settings.	tenant:manageuser:managerbac:manageaudit:read+3	2	global
Project Owner	Manages projects, requirements, test suites, and CI/CD within their tenant.	project:managerequirement:managetest:managerun:trigger+2	8	acme-bfsi
QA Engineer	Authors and executes tests, reviews failures, and triggers self-healing approval.	test:readtest:createrun:triggerheal:approve+1	24	acme-bfsi
CISO / Compliance	Read-only access to audit logs, model policies, and compliance evidence export.	audit:readmodel:readevidence:exportrbac:read	3	acme-bfsi
Read Only	View dashboards, test results, and reports — no write actions.	report:readrun:readtest:read	12	acme-bfsi

claude-haiku-4-5AnthropicApproved

Max tokens: 4,096PII filter: EnabledPrompt audit: OnData residency: EU / USApproved by alice@acme.com on 6/1/2024

claude-sonnet-4-5AnthropicUnder Review

Max tokens: 8,192PII filter: EnabledPrompt audit: OnData residency: EU only

gpt-4oOpenAIBlocked

Max tokens: N/APII filter: DisabledPrompt audit: OffData residency: Not approved

SOC 2 Type IIISO 27001GDPR

Framework	Control	Description	Status	Evidence	Last Tested
SOC 2 Type II	CC6.1	Logical and physical access controls	Passing	18items	2d ago
SOC 2 Type II	CC7.2	System monitoring and anomaly detection	Passing	12items	1d ago
SOC 2 Type II	CC8.1	Change management and deployment controls	Failing	3items	5d ago
ISO 27001	A.9.1.2	Access to networks and network services	Passing	9items	3d ago
ISO 27001	A.12.4.1	Event logging and log protection	Passing	24items	1d ago
GDPR	Art.32	Security of processing — encryption and pseudonymisation	Not Tested	0items	Never

4 of 6 controls passing · 1 failing — action required

User	Action	Resource	Outcome	IP	Time
alice@acme.com	evidence_export	compliance_pack cp-soc2-2024	Success	10.0.1.42	17h ago
bob@acme.com	rbac_role_assign	user carol@acme.com	Success	10.0.1.55	17h ago
dan@external.com	model_policy_override	model_policy mp-003	Blocked	203.0.113.10	18h ago
alice@acme.com	agent_approve	agent agt-002	Success	10.0.1.42	18h ago
ci-pipeline	test_run_trigger	test_suite ts-regression-881	Success	10.0.2.10	19h ago
eve@acme.com	rbac_escalation_attempt	role role-001	Blocked	10.0.1.99	20h ago

Showing 6 most recent events · Immutable, tamper-evident log

Tenant Isolation

✓ Enforced

SSO / SAML

✓ Active

PII Redaction

✓ Enabled

Prompt Audit Log

✓ On

Data Residency

✓ EU + US

Zero-trust Agents

✓ Governed

Encryption at Rest

✓ AES-256

Pen Test

⏳ Scheduled

All governance data is derived from platform-enforced controls — not self-attested. Evidence is exportable to GRC systems on demand.