Source: qdash /controls — c64 iteration 3, flat table + category column (non-destructive variation)
Define the standard once — condition, severity, decisions, and where it applies. Layer a framework on top to map qdash's live detections to its controls, and export the evidence packet for auditors.
Layer a framework onto your controls
1 of 6 enabledA pack maps qdash's live detections to that framework's controls and lights up Compliance coverage. Enablement persists locally.
Controls
control | category | severity | actions | matches |
|---|---|---|---|---|
Excessive agency (approvals & sandbox bypassed) run: labels has "yolo" | Agent autonomy | high | observealertenforce | 0 |
Agent running as root run: labels has "root-user" | Privilege | high | observealert | 0 |
Critical-posture agent run: posture_score < 50 | Posture | high | observealert | 0 |
Sandbox disabled run: sandbox_mode contains "danger" | Agent autonomy | medium | observeenforce | 0 |
No tool-approval policy run: approval_policy = "never" | Agent autonomy | medium | observealertenforce | 0 |
Non-allowlisted egress egress: allowlisted = false | Network egress | medium | observealertenforce | 83 → |
Weak TLS negotiated egress: weak_tls = true | Network egress | high | observealertenforce | 0 |
Sensitive file access file: severity in (high, medium) | Data access | high | observealertenforce | 0 |
Daily spend over budget usage: scope = "fleet" and cost_24h > 25 | Cost & consumption | medium | observealert | 1 → |
Quota overage rejected run: quota_status = "overage_rejected" | Cost & consumption | low | observe | 19 → |
Target breached target: state = "over" | Targets | medium | observealert | 0 |
Shadow AI (unmonitored install) install: covered = false | Coverage | medium | observealert | 4 → |
Evidence packet
c64 iteration 3 — category column: exactly the replica's flat DataTable (same expand-row details, same everything) plus one Category column rendering the GovernSheet category as a neutral chip. The lightest-touch option: no grouping chrome, no layout change, category becomes scannable and (in a real build) sortable/filterable. Compare: /pages/control-center (iteration 1, sections) · /pages/control-center-v2 (iteration 2, two-column grid). Same live-data snapshot (2026-08-10), same stubs.