Governance Runtime Controls

ControlCatalogv0.1.0draft

Controls for the Governance Runtime evaluation API and evidence record/report/aggregate behaviours against the Evidence Record.

Showing 4 of 4

ungrouped

apa-runtime-ctl-001-caller-authnAuthenticate Evaluation Callers

Objective

Accept evaluation requests only from authenticated, authorised Desktop Agent (or equivalent enforcement-point) callers.

Assessment Requirements

apa-runtime-ctl-001-ar01
When an evaluation request is received, the runtime MUST authenticate the caller and MUST reject unauthenticated requests.
Applicability: all

Threats apa-governance-runtime-threats

apa-runtime-ctl-002-model-bindingBind Evaluations to Loaded Governance Model

Objective

Ensure every evaluation cites the Governance Model version or artifact set used to produce the decision.

Assessment Requirements

apa-runtime-ctl-002-ar01
Evaluation responses and recorded evidence MUST identify the Governance Model artifacts (or release identifier) that informed the decision.
Applicability: all

Threats apa-governance-runtime-threats

apa-runtime-ctl-003-record-decisionsRecord Evaluation and Enforcement Outcomes

Objective

Persist ALLOW, DENY, and REQUIRE APPROVAL outcomes (and supporting evidence) to the Decisions and Evidence Record.

Assessment Requirements

apa-runtime-ctl-003-ar01
After each completed evaluation or enforcement action, the runtime MUST write an evidence object to the Evidence Record bucket.
Applicability: all

Threats apa-governance-runtime-threats

apa-runtime-ctl-004-report-and-aggregateReport and Aggregate Evidence for Assurance

Objective

Support retrieval and aggregation of recorded evidence for audit and AIMS management review.

Assessment Requirements

apa-runtime-ctl-004-ar01
The runtime MUST provide report and aggregate interfaces over Evidence Record objects sufficient for sample audit and management-review use.
Applicability: all

Threats apa-governance-runtime-threats