Compliance · GRC

Can we prove control over our agents to a framework — or an auditor?

4 of 4 tracked frameworks have behavioral evidence behind them. marketing-gpt drives the most high-severity findings (2 of 2). Every tracked framework has evidence on file. This is contributing evidence — not a conformance claim.

Conformance coverage

4/ 4

frameworks with ≥1 finding

High-severity

2mapped

3 medium also on file

Controls w/ findings

7controls

across 7 findings

Evidence-ready

100%

tracked frameworks with proof

Sensitive paths

6touched

9 opens across the fleet

Tracked frameworks — evidence vs. measurement gap

4 of 4 have evidence

A zero-finding framework is not a pass — it means we have no behavioral evidence either way. Treat it as a gap to close.

OWASP LLMevidence on file5 findings · 2 high

MITRE ATLASevidence on file2 findings · 1 high

NIST AI RMFevidence on file3 findings

OWASP Agenticevidence on file1 finding · 1 high

high-severity · medium / lower — bar length is evidence volume, not a score.

Coverage trajectory

fleet posture · 6 wk

76/ 100 now

on the recent slope, ~2 wk to the 80 target. Trend reflects evidence depth, not a conformance claim.

High findings by agent — who to chase

2 high findings mapped to controls

marketing-gpt

Findings carry the agent they were observed on — so an auditor question routes to an owner, not a queue.

Your surfaces

Compliance & Frameworks4/4 covered

Findings mapped to the controls you answer for.

Data Protection high6 paths

Sensitive files agents reached into the model context.

Findings high2 high · 3 med

The behavioral findings behind the controls.

Showback by User5 users

Attribute exposure and spend to a person or cost center.

Activity Logaudit trail

The timestamped, attributable why-trail behind every control.

Do next

Derived from app/data/c16-fleet.ts: conformance coverage = frameworks-with-evidence / frameworks-tracked over findings.framework · high findings grouped by findings.agent · sensitive paths from dlp.sensitive_paths / dlp.by_category · trajectory from postureIndexTrend / fleetPostureScore / weeksToTarget.