Phase 4

Finding detail

Source: c114 governance-phase2 — S1, the spine · surface-map.md §5 · 2026-10-09

One finding read without opening its session. Evidence above the line and never edited; the lifecycle below it as append-only rows, each with actor, time and cause; the response on the side with what it would reach. Rendered from the fixture world at the end of the Vanta story (runStory(RULED)); Ignore and Create exception act for real against a page-local copy, so the organ and the related counts move.

findingtypical — the Vanta story at its end: allowed, reopened, enforced; four rows

Findings/Unsanctioned MCP server in use/F-A

Unsanctioned MCP server in use · Vanta MCP

User A · Team A/mac-a1/Claude Code

Open session

Status

Resolved: enforced

Severity

high

Policy

Unsanctioned MCP server in use v3

Applies via

Organization-wide

Enforcement for User A

confirmed · 97 of 100 devices · by Organization-wide

Detected

2026-10-08 14:09

What happened

evidence · immutable

Vanta MCP connected at 14:09; 6 tool calls (list_controls, get_evidence …)

User User A · Team Team A

Device mac-a1 · Corporate Macs · Production

Agent Claude Code

MCP server Vanta MCP

Open at 14:09 in S-1 → the timeline point that generated this finding

Why it violates

Detect use of an MCP server that is not sanctioned for the applicable user, team, device, or other governed scope.

Evaluated by

Unsanctioned MCP server in use v3

Reached User A through

direct · Organization-wide spec 0

Exceptions considered

E-GRC: Vanta MCP for Team: GRC — does not cover Team A
E-A: Vanta MCP for Team: Team A — revoked 2026-10-14

Still a violation under the policy as configured now:yes

Lifecycle

4 rows · append-only

Now:Resolved: enforcedsince 2026-10-14 08:00 · qdash · “Exception E-A revoked: Team A moved off Vanta”

timeactorwhat → statecause

2026-10-08 14:09qdashdetected → openpolicy evaluation

2026-10-09 09:15qdashre-evaluated → resolved: allowedCH-1Exception: allow Vanta MCP for Team A

2026-10-14 08:00qdashreopened → openCH-5Exception E-A revoked: Team A moved off Vanta

2026-10-14 08:00qdashenforcement confirmed → resolved: enforcedCH-5Exception E-A revoked: Team A moved off Vanta

Related findings

same policy, other subjects · 1 (0 open · 1 resolved)see all 1 →

findingsubjectresourcedetectedstatus

User B · Team BVanta MCP2026-10-08Resolved: enforced

Composition notes

Evidence and state are two blocks: What happened is sunken and marked immutable; Lifecycle is the organ, append-only, every row with actor, time and cause. The c79 finding-detail split (occurrence stream vs audit record) survives as this; the occurrence stream itself is the recurrence open question [finding] and is not drawn.
"Why it violates" is computed, not written: the scope paths, the exceptions considered and "still a violation now" come from applicability(). When a finding is open but no longer violates, the page says re-evaluation would resolve it.
The Respond aside carries reach from [investigate]: Allow and Ignore are live against a page-local world (S8, S8b drafted here); Block and Remediate are seams to S6 and the ticket tracker. Enforced and Policy changed never appear as verbs — they are system rows.
Reused (D8): the c79 crumb row and identity card shape; the adjudication card's verb-then-capture pattern and its mandatory-field gating; the layer's SeverityTag, UxTabGroup and UxPageTitle. Changed: Ignore needs a duration; accept-risk folds into Ignore-until-date; the SLA clock line is not drawn here (no intent asks; decide at review).
Sticky band, jump pills and the qdash PageHeader are the port's concern, not drawn. Related shows 5 and says so. Four states: ?findingId=F-A · F-S01 · F-S04 · F-NOPE.