sha3:36276f8499332ad9a9e3536ec02a8abfc45db2b7592863e409878cc750a22bc1IntactRegister / Mechanism
How the record gets written.
PolicyCortex is software that runs inside your tenant. Collectors read your cloud control planes and write hashed state records. Policy gates rule on every change the software makes, and on every autonomous action, before it runs. An append-only SHA3-256 chain keeps the records. An export surface projects them into OSCAL 1.1.2, SSP, SAR, POA&M and eMASS XML.
Exhibit M-1 · the package the export surface produces: inventory, validations, POA&M, SSP, SAR. One ZIP, hash chained, AES-256 protected. Illustrative demo data; the interface is real.
3324e49c278aa103809d5bf4001f94dc380abb0a6ad54a58d572d550a83c4832prev:076b67657b91Five components, one chain.
Five components, all inside your tenant, around one chain. Where each one runs and what it cannot reach is stated as network facts in the architecture; this record states what each one does.
- collectors
- Read your cloud control planes with read scope: Azure, AWS, and GCP, including GovCloud and GCC High. Write one state record per resource per capture, with the raw provider response stored as the proof.
- policy.engine
- Evaluates every gate locally against the evidence store and the recorded resource state. A gate that needs the internet to say no is not a gate.
- evidence.store
- Append-only JSONL. SHA3-256 content hashes, hash chained per stream, seven-year retention, regenerable as of any historical timestamp. There is no update or delete verb.
- decision.layer
- Proposes a captureState and restoreState pair and publishes a confidence figure. Cannot execute directly: execution requires 3/3 gates plus the trust mode you set.
- export.surface
- Reads the store to generate attestation artifacts: OSCAL 1.1.2 native, with SSP, POA&M, and SAR produced from one implementation record. Has no write path to the store.
See alsoWhere each component runsThe chain, and what a break looks like
56ce07e8b4c8ccb4ea6692081f9dbc0b9e862c5782a89777214c1ad8f36be7f6prev:3324e49c278aWhat the mechanism produces.
The mechanism exists to produce three records. Each one is a page on this site with the field names, a verification run, and a stated limit.
Proof of state
What a cloud environment was, captured from the provider APIs, content hashed, chained to the record before it, regenerable to any date inside retention.
Read the recordPROOF 02 / CHANGEProof of change
Who or what altered the environment, under what authority, with before and after state hashes and a rollback identifier, on a chain that cannot be edited without detection.
Read the recordPROOF 03 / AGENCYProof of agency
What a machine was permitted to do before it acted, what it actually did, and what would have stopped it one notch different.
Read the recorde141f24ac91fd8b14f1e9831003701e8091d5f30d59cbd087f556c456c9dc0ddprev:56ce07e8b4c8How a change is allowed to happen.
Every change the software makes, and every autonomous action, runs inside the same wrapper. The action is never the first thing that happens and never the last, and each stage writes its own record to the chain.
- 00 DETECT
- The condition is observed and recorded before anything is proposed. An unobserved scope is a declared gap, not a silence.
- 01 PRE-CHECK
- Blast radius bounded against the autonomy envelope. Target state pinned by hash. Policy gates evaluated: 3/3 required, or the action stops here and the stop is recorded.
- 02 DECISION
- The reasoning layer proposes a captureState and restoreState pair and publishes its confidence. It cannot execute. In GATED mode, this is where the human signs.
- 03 EXECUTE
- The action runs inside the envelope it passed at pre-check, within the change window, under the cost ceiling.
- 04 VERIFY
- The state delta is hashed and compared to what was proposed. A mismatch triggers automatic rollback, and the mismatch is recorded either way.
- 05 ROLLBACK ID
- The record closes with an identifier that reverses this exact action through a single API call.
The trust mode on the envelope decides who signs. SHADOW watches and executes nothing. GATED, the default, puts a named human on every action. AUTONOMOUS exists only for narrow, well-tested action classes, and still runs every gate on every act. The envelope's cost ceiling has its own page.
See alsoThe autonomy envelopeProof of agencyThe engine and the cageThe cost ceiling
24f5d92f1adee12dfa2f0f81195a8ae50dc38071d4f0e5fe1d146cf46705a217prev:e141f24ac91fHow the record becomes a package.
The documents assessors ask for are projections of the record, not parallel artifacts maintained by hand. SSP, SAR, and POA&M generate from one implementation record; the package exports as OSCAL 1.1.2, with eMASS XML and evidence indexes from the same source. Monitoring against NIST 800-53, NIST 800-171, and CIS benchmarks is written as evidence on the same chain.
- ato.packaging
- ATO packaging: SSP, SAR, POA&M, OSCAL 1.1.2 and eMASS XML from one implementation record, regenerable as of any timestamp.
- monitoring
- Compliance monitoring: NIST 800-53, NIST 800-171 and CMMC Level 2, CIS benchmarks: every observation hashed, timestamped, chained, retained seven years.
- federal
- The federal record: The same record in the shape a program office expects: ATO, FedRAMP 20x, 800-53, 800-171, CMMC Level 2.
5aa66e8dc1ff283926c6e5ef729e501f44a5c648041376318472fa17eada9e10prev:24f5d92f1adeHow you check it.
Run it against your own environment. Read only. Fourteen days. A read-only connection is enough to produce your first state records and your first declared gaps, inside your tenant, against your resources. Then recompute the chain: it returns INTACT, or the first sequence number where integrity fails, with no PolicyCortex account or API in the loop.
36276f8499332ad9a9e3536ec02a8abfc45db2b7592863e409878cc750a22bc1prev:5aa66e8dc1ffWhat it does not do.
Watch the record get written in your own tenant.
Request verification