Source: qdash /controls + /policy + /compliance — c64 consolidation concepts, 2026-08-10
Three qdash pages render this territory with four framework vocabularies, three localStorage stores, and three match-count algorithms that show different numbers for the same control (findings F1–F10 in cycles/c64…/current-state.md). Four initial concepts — not solutions; the in-depth design pass follows. Idea 1 is the zero-IA-change fruit every other idea assumes. Ideas 2 and 4 are the two structural answers for the deep pass to adjudicate. All four ride one dataset: the normalized vocabulary (c17 five-family grouping over rules.rs pack ids).
One vocabulary
resolves F1 · F2 · F3The normalized control table: one display name per control (hyphenation split resolved by fiat), one family grouping (c17), pack chips straight from the backend's rules.rs::PACKS via /api/control-vocab — the seam GovernSheet already uses. The two match counts are shown as distinct labeled numbers ("findings" vs "would-catch") instead of silently different per page.
Sandbox Required sandbox | live | 3 findings | owasp-llmowasp-asinist-airmfsoc2iso-27001nist-csfeu-ai-act |
No Approvals Bypass yolo | live | 1 findings | owasp-llmowasp-asinist-airmfsoc2 |
Require Tool Approval approval | projected | 0 findings12 would-catch | owasp-llmowasp-asinist-airmfeu-ai-act |
Tool Allow-List — no backend control yet | projected | 0 findings7 would-catch | owasp-llmowasp-asi |
No Root Execution root | live | 1 findings | owasp-llmowasp-asisoc2iso-27001nist-csf |
Telemetry Required shadow | live | 5 findings | nist-airmfsoc2nist-csf |
Org-Backed Identity — no backend control yet | live | 2 findings | soc2iso-27001mitre-atlas |
Deny Credential Reads sens | live | 2 findings | owasp-llmmitre-atlassoc2iso-42001iso-27001nist-csfeu-ai-act |
Egress Allow-List egress | live | 0 findings18 would-catch | owasp-llmmitre-atlassoc2iso-27001nist-csf |
TLS Floor weakTls | projected | 0 findings4 would-catch | nist-800-52nist-csf |
Spend Ceiling — no backend control yet | projected | 1 findings | owasp-llmnist-airmfiso-42001 |
Prompt Inspection — no backend control yet | roadmap | 0 findings | owasp-llmeu-ai-act |
Output Validation — no backend control yet | roadmap | 0 findings | owasp-llmeu-ai-act |
Provenance Pinning — no backend control yet | roadmap | 0 findings | owasp-llmiso-42001eu-ai-act |
One surface, three lenses
resolves F1 · F6 · F8 — recommendedThe IA doc's answer, built: Control Center is the one surface; Controls authors, Enforcement is a read-only enforce lens over the same rows, Coverage is the framework view. The /policy page stops existing as a place — its cascade becomes the Enforcement lens, its coverage matrix becomes the Coverage lens. One GovernSheet vocabulary ("Edit") everywhere.
| Control | Severity | Mode | Matches | + New control |
|---|---|---|---|---|
Sandbox Required sandbox · Agent Autonomy | high | alert | 3 findings → Findings | Edit → |
No Approvals Bypass yolo · Agent Autonomy | crit! | observe | 1 findings → Findings | Edit → |
Require Tool Approval approval · Agent Autonomy | medium | observe | 0 findings → Findings | Edit → |
No Root Execution root · Privilege & Identity | crit! | enforce | 1 findings → Findings | Edit → |
Telemetry Required shadow · Privilege & Identity | high | observe | 5 findings → Findings | Edit → |
Deny Credential Reads sens · Data Protection | crit! | alert | 2 findings → Findings | Edit → |
Egress Allow-List egress · Data Protection | high | observe | 0 findings → Findings | Edit → |
TLS Floor weakTls · Data Protection | medium | observe | 0 findings → Findings | Edit → |
Pack toggle = the bridge
resolves F2 · F4 · F5Compliance reframed as the IA doc's §7.5: the coverage view of enabled packs — one rendering instead of three. Toggle a pack and the coverage recomputes live (try it), split into three honest buckets by control reach. One evidence CTA, pointed at the server packet. Enabling a pack here and in Control Center is the same store.
Act/Prove split
resolves F1 · F8 — the alternative to Idea 2The other structural answer: two pages, not three. ACT = Control Center with enforcement folded in as a Mode column (no separate lens); PROVE = Compliance as Idea 3. The cascade's Global row becomes a single page-level mode control. Cheaper to hold in the head, but authoring and blast-radius share one table — the deep pass adjudicates this against Idea 2's separation.
| Control | Mode | Findings | Would block |
|---|---|---|---|
| Sandbox RequiredAgent Autonomy | alert | 3 | 3 |
| No Approvals BypassAgent Autonomy | observe | 1 | 1 |
| Require Tool ApprovalAgent Autonomy | observe | 0 | 12 |
| No Root ExecutionPrivilege & Identity | enforce | 1 | 1 |
| Telemetry RequiredPrivilege & Identity | observe | 5 | 0 |
| + 3 more controls | |||