Four layers, one pipeline step, and a record nobody can quietly edit.
Most teams have the first two. The last two are where outages stop.
What must be true, in one sentence. Production data is encrypted at rest.
Where it applies, how, and what the exceptions are. Written in plain language, so your engineers and your AI read the same document.
The named, testable check that proves the policy holds. CTL-DAT-0001, mapped to CIS 2.1.1 and SOC 2 CC6.1.
The automation that stops it happening at all. The pull request fails. The unencrypted database is never created.
Added between your plan and your apply. Nothing else changes.
- run: |
terraform show -json tfplan.bin > tfplan.json
guardai audit --plan tfplan.json --emit-evidence chain.json --out report.html
- run: guardai publish --chain chain.json --repo-label acme-prod-infra
if: always()
env:
GUARDAI_INGEST_TOKEN: ${{ secrets.GUARDAI_INGEST_TOKEN }}
You can see this yourself before sending anything. guardai publish --dry-run prints the payload and transmits nothing.
The dashboard supplies the titles and the framework references from its own catalog, which is why your dashboard is readable by an auditor and contains none of your infrastructure.
Every evaluation is written to a chain. Each entry carries the hash of the one before it, so removing or editing an entry breaks every hash after it.
That is what an auditor is asking for when they say prove it held for the whole period. Not a dashboard showing today. A record where removal is detectable.
Your customer's reviewer verifies it themselves, offline, without trusting you and without contacting us. Evidence that only holds up while the vendor is still in business is not evidence.
A model can propose a patch. A deterministic engine decides, and the model never holds credentials that can write.
Suppressing a finding is rejected, always. A remediation that silences a detector fails harder than the finding it was hiding, because the cheapest way to close a finding is to stop looking for it.