Platform
Your compliance program, connected.
Monitor controls, manage remediation, and collect evidence inside your tenant. Track implementation and open gaps, then prepare review packages from the same verifiable record.
Five components, one chain.
Five components, all inside your tenant, around one chain. Where each one runs and what it cannot reach is stated as network facts in the architecture; this record states what each one does.
- collectors
- Read your cloud control planes with read scope: Azure, AWS, and GCP, including GovCloud and GCC High. Write one state record per resource per capture, with the raw provider response stored as the proof.
- policy.engine
- Evaluates every gate locally against the evidence store and the recorded resource state. A gate that needs the internet to say no is not a gate.
- evidence.store
- Append-only JSONL. SHA3-256 content hashes, hash chained per stream, seven-year retention, regenerable as of any historical timestamp. There is no update or delete verb.
- decision.layer
- Proposes a captureState and restoreState pair and publishes a confidence figure. Cannot execute directly: execution requires 3/3 gates plus the trust mode you set.
- export.surface
- Reads the store to generate attestation artifacts: OSCAL 1.1.2 native, with SSP, POA&M, and SAR produced from one implementation record. Has no write path to the store.
See alsoWhere each component runsThe chain, and what a break looks like
What the mechanism produces.
The mechanism exists to produce three records. Each one is a page on this site with the field names, a verification run, and a stated limit.
Proof of state
What a cloud environment was, captured from the provider APIs, content hashed, chained to the record before it, regenerable to any date inside retention.
Read the recordPROOF 02 / CHANGEProof of change
Who or what altered the environment, under what authority, with before and after state hashes and a rollback identifier, on a chain that cannot be edited without detection.
Read the recordPROOF 03 / AGENCYProof of agency
What a machine was permitted to do before it acted, what it actually did, and what would have stopped it one notch different.
Read the recordHow a change is allowed to happen.
Every change the software makes, and every autonomous action, runs inside the same wrapper. The action is never the first thing that happens and never the last, and each stage writes its own record to the chain.
- 00 DETECT
- The condition is observed and recorded before anything is proposed. An unobserved scope is a declared gap, not a silence.
- 01 PRE-CHECK
- Blast radius bounded against the autonomy envelope. Target state pinned by hash. Policy gates evaluated: 3/3 required, or the action stops here and the stop is recorded.
- 02 DECISION
- The reasoning layer proposes a captureState and restoreState pair and publishes its confidence. It cannot execute. In GATED mode, this is where the human signs.
- 03 EXECUTE
- The action runs inside the envelope it passed at pre-check, within the change window, under the cost ceiling.
- 04 VERIFY
- The state delta is hashed and compared to what was proposed. A mismatch triggers automatic rollback, and the mismatch is recorded either way.
- 05 ROLLBACK ID
- The record closes with an identifier that reverses this exact action through a single API call.
The trust mode on the envelope decides who signs. SHADOW watches and executes nothing. GATED, the default, puts a named human on every action. AUTONOMOUS exists only for narrow, well-tested action classes, and still runs every gate on every act. The envelope's cost ceiling has its own page.
See alsoThe autonomy envelopeProof of agencyThe engine and the cageThe cost ceiling
How the record becomes a package.
The documents assessors ask for are projections of the record, not parallel artifacts maintained by hand. SSP, SAR, and POA&M generate from one implementation record; the package exports as OSCAL 1.1.2, with eMASS XML and evidence indexes from the same source. Monitoring against NIST 800-53, NIST 800-171, and CIS benchmarks is written as evidence on the same chain.
- ato.packaging
- ATO packaging: SSP, SAR, POA&M, OSCAL 1.1.2 and eMASS XML from one implementation record, regenerable as of any timestamp.
- monitoring
- Compliance monitoring: NIST 800-53, NIST 800-171 and CMMC Level 2, CIS benchmarks: every observation hashed, timestamped, chained, retained seven years.
- federal
- The federal record: The same record in the shape a program office expects: ATO, FedRAMP 20x, 800-53, 800-171, CMMC Level 2.
How you check it.
Request Access and agree on scope with our team before onboarding. A read-only connection can produce state records and declared gaps inside your tenant, against your resources. Then recompute the exported chain: it returns INTACT, or the first sequence number where integrity fails, with no PolicyCortex account or API needed to verify the export.
What it does not do.
Watch the record get written in your own tenant.
Request Access