Source: qdash /controls — 1:1 replica (c64 iteration starting point, data snapshot 2026-08-10)
Define the standard once — condition, severity, decisions, and where it applies. Layer a framework on top to map qdash's live detections to its controls, and export the evidence packet for auditors.
Layer a framework onto your controls
1 of 6 enabledA pack maps qdash's live detections to that framework's controls and lights up Compliance coverage. Enablement persists locally.
Controls
control | severity | actions | matches |
|---|---|---|---|
| Agent autonomy | |||
Excessive agency (approvals & sandbox bypassed) run: labels has "yolo" | high | observealertenforce | 0 |
Sandbox disabled run: sandbox_mode contains "danger" | medium | observeenforce | 0 |
No tool-approval policy run: approval_policy = "never" | medium | observealertenforce | 0 |
| Privilege | |||
Agent running as root run: labels has "root-user" | high | observealert | 0 |
| Posture | |||
Critical-posture agent run: posture_score < 50 | high | observealert | 0 |
| Network egress | 83 | ||
Non-allowlisted egress egress: allowlisted = false | medium | observealertenforce | 83 → |
Weak TLS negotiated egress: weak_tls = true | high | observealertenforce | 0 |
| Data access | |||
Sensitive file access file: severity in (high, medium) | high | observealertenforce | 0 |
| Cost & consumption | 20 | ||
Daily spend over budget usage: scope = "fleet" and cost_24h > 25 | medium | observealert | 1 → |
Quota overage rejected run: quota_status = "overage_rejected" | low | observe | 19 → |
| Targets | |||
Target breached target: state = "over" | medium | observealert | 0 |
| Coverage | 4 | ||
Shadow AI (unmonitored install) install: covered = false | medium | observealert | 4 → |
Evidence packet
Replica of qdash /controls (live snapshot 2026-08-10: 12 seeded controls, 107 findings, matches egress 83 · quota 19 · shadow 4 · budget 1) + iteration 1: category sections — controls grouped by their GovernSheet category using /policy's section-row idiom (surface-sunken-deeper band, heavy top rule between sections), dropdown order, empty categories dropped, per-section control count + rolled-up match total on the section row. DataTable was swapped for its underlying UxTableList to host the section rows; every cell and the expand-row details are unchanged. Pack enablement is a local ref standing in for localStorage['qdash.packs']; GovernSheet, downloads, and cross-page links are stubbed.