Phase 4
Governance Model
Source: c114 governance-phase2 — Phase 1, the model on a page · 2026-10-09
The fourteen intents in qpoint-io/intents read as one object model, rendered live from app/data/governance-fixture.ts. One invariant runs through every file: evidence is immutable, state is mutable, and every change of state records who, when and which change caused it. The rulings below are inputs to the same functions the mocks will use, so the alternative to each ruling stays one click away.
Rulings
Mark, 2026-10-09 (CYCLE.md D1–D3) and 2026-10-18 (D9); the Oct 19 model (c118: the 2026-10-19 product session, Mark's answers 2026-10-20), which puts the mode on the policy and every nuance in exceptions, with c114 as drawn kept as its alternative. Each switch re-runs the story, the probe and the coverage below.
Policy structureA1–A5 · B3
Oct 19: one mode per policy; exceptions set the mode or a knob per org / team / user, narrowest wins; no groups, no finding Ignore ruled
Vanta storyQ5
Team A is exempted from the MCP policy by a mode exception (Off) — what the beta ships ruled
Scope precedenceD1
CSS specificity: org < team < user; an exception is a more specific allow ruled
Re-evaluationD2
a change re-checks the open findings it touches; a later change can reopen ruled
Proof of enforcementD3
Enforced only once qdash observed the action take effect ruled
Equal-specificity tiesD9
equal-specificity scopes that disagree: Enforce beats Observe, nothing to resolve ruled
The chain
Frameworks never generate findings and are never enforced. Policies are the testable unit; a failed evaluation of session activity generates a Finding; everything hanging off a Policy (scope, groups, exceptions, enforcement) decides what "applies" means for one subject. Counts are the fixture world, folded under the rulings above.
Framework (6) · edition, mapping revision, tracking preference
└─ Control (58) · native groups · the source's term in its description
↔ Policy (19) · many-to-many · canonical, Qpoint-owned
├─ Rule · the predicate · internal (qdash Control.rule)
├─ Severity · recommended → override (1) → effective
├─ Scope, direct (14) ──┐
├─ Policy Group → Scope (4) ┤→ effective applicability (D1)
├─ Exception (1) · policy × narrower scope → allow one resource
└─ Enforcement State (8) · policy × scope · observe | configured | confirmed (D3)
│
Policy Evaluation of Session activity (sessions: 21)
│
Finding (22: 10 open · 12 resolved)
├─ evidence · immutable · session, timeline point, severity and policy version at generation
└─ lifecycle · mutable · a fold over FindingEvents (42) each with actor · time · cause → Change (6)
Open ⇄ Resolved: ignore | now enforced | policy changed | allowed · outcome at detection: Enforced | Observed (c121 D16)
Objects
What is stored and what is derived. Derived values are computed on every read and marked as such on every surface (c108).
Session21
The chronological record of one agent–user interaction. Findings sit in its timeline at the point that caused them.
activitytool callsresourcesfindings in timeline · derived
[session]Finding22 · 10 open
One independently addressable violation. Evidence immutable; lifecycle a fold over events.
policy + versionsessionsubjectresourceseverity at generationeventsstatus · derivedresolution · derivedrelated · derived
[finding] [investigate]Policy19
A testable rule. Canonical and Qpoint-owned; the org configures around it, never inside it.
definitionrecommended severitycapabilitymappingseffective severity · derivedapplicability · derivedcounts · derived
[catalog] [policy]Scope14 direct
Where a policy applies, by dimension. Assigned directly or through a group; paths shown, never duplicated.
dimensionvaluepaths · derivedpopulation · derived
[scope]Policy Group4
A reusable set of policies with its own scope. References, never copies.
policiesscopestateeffective policies · derived
[groups]Exception1
A scoped allow for one resource. Narrows a policy; never removes a scope. Its intent is missing (G1).
policyscoperesourcereasonduration
[scope] [enforce] [ignore]Enforcement State8
Per policy × scope: observe, configured, confirmed. Disabling returns to observe, never stops evaluation.
levelreacheffective enforcement · derived
[enforce]Resolution · FindingEvent42 events
Why a finding stopped needing action: ignore (with duration), enforced (linked to its change), policy-changed, allowed.
kindactortimereasondurationcause
[resolve] [ignore] [reeval]Framework · Control6 · 58
External standards and taxonomies. Controls map many-to-many to policies; never generate findings. Tracking is a reporting preference and changes no policy.
publishereditiontypesource linknative groupscontrolsmapping revisionstracking logEnforcement Posture · derivedposture history · derivedExceptions by direction · derivedcoverage · derived
[framework] [catalog] [manage-framework] [view-and-manage-frameworks]Change6
One record for every auditable change a FindingEvent can point at. A modelling choice; the intents name them separately.
kindactortimebefore/afterscope
[resolve] [reeval] [enforce]Exceptions across the adoption lifecycle
An exception sets a policy's mode for a team or a person, so it can tighten the policy or loosen it. Which one an organization reaches for depends on how far it has rolled Qpoint out. The lab seeds both stages: switch with stage in the mock bar, or follow the links below.
Initial adoptionPolicy Config v3
Observe broadly across the organization; create exceptions that Enforce for a pilot team or selected users.
Organization0 enforce · 17 observe · 2 off
Engineering3 enforce · 14 observe · 2 off
Every enforceable policy observes. Engineering enforces three of them, and Dev and Riley each pilot one ahead of their teams. The shared draft proposes the next step: Finance enforces the MCP policy.
Exceptions in force · 5
EnforceTeam: Engineering · Unsanctioned MCP server in use
EnforceTeam: Engineering · Approved model providers only
EnforceUser: Dev · Restricted file access
EnforceTeam: Engineering · Sensitive information sanitized before transmission
EnforceUser: Riley · Sensitive information sanitized before transmission
Open findings: 0 Enforced, 23 Observed (hidden by default).
Established rolloutPolicy Config v13
Enforce broadly across the organization, with exceptions that Observe or turn Off where needed.
Organization2 enforce · 12 observe · 5 off
GRC1 enforce · 12 observe · 6 off
Settled policies enforce for everyone, and exceptions carry the departures: a team exempt for an approved workflow, a team still evaluating, a person observing until a date. Enforce exceptions stay where a team got there before the organization.
Exceptions in force · 7
OffTeam: GRC · Unsanctioned MCP server in use
EnforceTeam: Finance · Unsanctioned MCP server in use
ObserveTeam: Engineering · Unsanctioned MCP server in use
EnforceTeam: Finance · Prohibited data classes must not leave an approved boundary
EnforceTeam: Finance · Restricted file access
EnforceTeam: Engineering · Approved model providers only
ObserveUser: Jordan · Approved model providers only
Open findings: 0 Enforced, 7 Observed (hidden by default).
The Vanta story, run to its end
The example nearly every intent uses: Vanta MCP used by User A (Team A) in Session 1 and User B (Team B) in Session 2, and a personal account in Session 1. Six changes, each applied by applyChange() and re-evaluated under the rulings. If the stepper cannot reach the end, the model has a hole.
startThree findings detected
F-AOPEN
Unsanctioned MCP server in use
User A · Team A · S-1
F-BOPEN
Unsanctioned MCP server in use
User B · Team B · S-2
F-COPEN
Personal account is in use
User A · Team A · S-1
step 1Exempt Team A from the MCP policy2026-10-09 09:15 · Dana (security admin)
Exception: Off for Team A — Team A owns the Vanta integration — A3 — a mode exception (Off) for Team A; Finding A resolves as Allowed, B and C must not
F-ARESOLVED · allowed
Unsanctioned MCP server in use
User A · Team A · S-1
reevaluate · qdash · cause CH-1
F-BOPEN
Unsanctioned MCP server in use
User B · Team B · S-2
F-COPEN
Personal account is in use
User A · Team A · S-1
step 2Enforce the MCP policy2026-10-09 09:40 · Dana (security admin)
Mode set to Enforce: block the MCP connection — [enforce] A2 — the policy's mode goes to Enforce; configured until qdash confirms it (D3); Team A's exception still decides for Team A
F-ARESOLVED · allowed
Unsanctioned MCP server in use
User A · Team A · S-1
reevaluate · qdash · cause CH-1
F-BOPEN · pending
Unsanctioned MCP server in use
User B · Team B · S-2
enforcement configured, not yet confirmed
F-COPEN
Personal account is in use
User A · Team A · S-1
- F-B stays open: enforcement is configured for User B but not yet confirmed (D3)
step 3qdash sees the block take effect2026-10-09 11:05 · qdash
Enforcement confirmed on 97 of 100 devices (Vanta MCP blocked on mac-b1 at 11:05) — [enforce] [resolve] — c121 D16: the open findings resolve "now enforced on this endpoint", linked to the change; they stay Observed
F-ARESOLVED · allowed
Unsanctioned MCP server in use
User A · Team A · S-1
reevaluate · qdash · cause CH-1
F-BRESOLVED · now enforced
Unsanctioned MCP server in use
User B · Team B · S-2
enforce-confirmed · qdash · cause CH-3
F-COPEN
Personal account is in use
User A · Team A · S-1
step 4Exempt User A from the personal-account policy until 31 Oct2026-10-09 11:30 · Dana (security admin)
Exception: Off for User A until 2026-10-31 — migrating to the enterprise account — A3 A4 A7 — a user exception with a by-when; Finding C resolves as Allowed (no finding-level Ignore, B3)
F-ARESOLVED · allowed
Unsanctioned MCP server in use
User A · Team A · S-1
reevaluate · qdash · cause CH-1
F-BRESOLVED · now enforced
Unsanctioned MCP server in use
User B · Team B · S-2
enforce-confirmed · qdash · cause CH-3
F-CRESOLVED · allowed
Personal account is in use
User A · Team A · S-1
reevaluate · qdash · cause CH-4
step 5Revoke the Team A exception2026-10-14 08:00 · Dana (security admin)
Exception E-A revoked: Team A moved off Vanta — [reeval] — a later change reopens what re-evaluation resolved, and confirmed enforcement resolves it, now enforced (D2, D16)
F-ARESOLVED · now enforced
Unsanctioned MCP server in use
User A · Team A · S-1
enforce-confirmed · qdash · cause CH-5
F-BRESOLVED · now enforced
Unsanctioned MCP server in use
User B · Team B · S-2
enforce-confirmed · qdash · cause CH-3
F-CRESOLVED · allowed
Personal account is in use
User A · Team A · S-1
reevaluate · qdash · cause CH-4
step 6The clock passes 31 Oct2026-11-01 00:00 · clock
Now is 2026-11-01 — A7 — dated exceptions lapse (the system moves them): User A's ends and Finding C reopens; GRC's migration window closes and F-S04 resolves, now enforced
F-ARESOLVED · now enforced
Unsanctioned MCP server in use
User A · Team A · S-1
enforce-confirmed · qdash · cause CH-5
F-BRESOLVED · now enforced
Unsanctioned MCP server in use
User B · Team B · S-2
enforce-confirmed · qdash · cause CH-3
F-COPEN
Personal account is in use
User A · Team A · S-1
reopen · qdash · cause CH-6
- F-S01 stays open: enforcement is configured for Priya but not yet confirmed (D3)
- F-S02 stays open: enforcement is configured for Dev but not yet confirmed (D3)
- F-S03 stays open: enforcement is configured for User B but not yet confirmed (D3)
The lifecycle organ
The same rows on every surface that shows a Finding: actor · time · what · cause. Evidence above the line never changes; the rows only append.
F-Ahigh at generation
Vanta MCP connected at 14:09; 6 tool calls (list_controls, get_evidence …)
S-1 · 2026-10-08 14:09 · policy v3
10-08 14:09detect · qdash
10-09 09:15reevaluate → allowed · qdash · CH-1Exception: Off for Team A — Team A owns the Vanta integration
10-14 08:00reopen · qdash · CH-5Exception E-A revoked: Team A moved off Vanta
10-14 08:00enforce-confirmed → now-enforced · qdash · CH-5Now enforced on mac-a1
F-Bhigh at generation
Vanta MCP connected at 16:34; 2 tool calls
S-2 · 2026-10-08 16:34 · policy v3
10-08 16:34detect · qdash
10-09 11:05enforce-confirmed → now-enforced · qdash · CH-3Now enforced on mac-b1
F-Chigh at generation
Provider account usera@gmail.com, not organisation-backed
S-1 · 2026-10-08 14:02 · policy v2
10-08 14:02detect · qdash
10-09 11:30reevaluate → allowed · qdash · CH-4Exception: Off for User A until 2026-10-31 — migrating to the enterprise account
11-01 00:00reopen · qdash · CH-6Now is 2026-11-01
Effective policies for one subject
The D1 function. Pick a person: every policy that reaches them, by which paths, what enforcement decides for them, and where two assignments the ruling cannot separate disagree. This is the preview the scope, enforcement and group surfaces reuse.
priya-x1 · Production Macs · Production · Cursor CLI
PolicyApplies viaEnforcementSeverity
Unsanctioned MCP server in use
direct · Organization-wide
Engineering AI Controls · Team: Engineering
observe
decided by Team: Engineering
high
recommended medium
Personal account is in use
direct · Organization-wide
observe
high
Sensitive information detected before transmission to an LLM
direct · Organization-wide
observe
high
Sensitive information sanitized before transmission
direct · Organization-wide
Corporate AI Baseline · Organization-wide
Engineering AI Controls · Team: Engineering
configured · 97 of 100 devices
decided by Organization-wide
high
Prohibited data classes must not leave an approved boundary
not in scope
none
critical
Approved model providers only
tie: Device group: Production Macs (confirmed) is stricter than Environment: Production (observe) at equal specificity — the stricter wins (D9)
direct · Team: Engineering
Corporate AI Baseline · Organization-wide
Engineering AI Controls · Team: Engineering
confirmed · 12 of 12 devices
decided by Device group: Production Macs
medium
Enterprise accounts required
Corporate AI Baseline · Organization-wide
Engineering AI Controls · Team: Engineering
observe
high
Restricted file access
not in scope
none
high
Agent traffic must use approved encrypted transport
not in scope
none
medium
Consequential tool calls require approval
direct · Organization-wide
observe
medium
Tools must be on the allow list
direct · Organization-wide
observe
medium
Prompts are inspected for injection and leakage
direct · Organization-wide
observe
medium
Credentials must not be sent to a model
direct · Organization-wide
observe
critical
MCP servers and skills are pinned to reviewed versions
not in scope
none
medium
Model output is validated before tool execution
direct · Organization-wide
observe
high
Agents run in a sandbox
direct · Organization-wide
observe
high
Agents may not run as root
direct · Organization-wide
observe
high
Agent sessions are recorded
direct · Organization-wide
observe
medium
Spend stays under the ceiling
not in scope
none
low
Enforcement Posture and Exceptions
Two metrics, never folded together, over what Qpoint can know and govern. Enforcement Posture is how much of the work toward ideal is done: a policy-to-control mapping is at ideal when its policy reaches the strongest mode it can, so 100% means Qpoint's part is done, not that the framework is met. Exceptions read by direction and never move the score. Tracking changes neither.
| Framework | Edition · mapping | Posture | At ideal | To change | Exceptions |
|---|---|---|---|---|---|
| OWASP Top 10 for LLM Applications | 2025 · 2026.2 | 40% | 10 of 25 | 10 | 7 active: 3 tighten, 2 loosen, 2 match the default · 1 expiring |
| OWASP Top 10 for Agentic Applications | 2026 · 2026.1 | 40% | 12 of 30 | 10 | 6 active: 2 tighten, 2 loosen, 2 match the default · 1 expiring |
| NIST AI Risk Management Framework | 1.0 (Jan 2023) · 2026.1 | 47% | 18 of 38 | 9 | 6 active: 2 tighten, 2 loosen, 2 match the default · 1 expiring |
| Example: everything at ideal | lab · lab.1 | 100% | 8 of 8 | 0 | 3 active: 0 tighten, 2 loosen, 1 match the default |
| ISO/IEC 27001 | 2022 · 2026.1 | 50% | 2 of 4 | 2 | 2 active: 2 tighten, 0 loosen |
| SOC 2 | TSC 2017 (2022 points of focus) · 2026.1 | 41% | 11 of 27 | 11 | 7 active: 3 tighten, 2 loosen, 2 match the default · 1 expiring |
Framework coverage, derived
Coverage comes from mapped policies, never from an assertion. Three things stay distinct per requirement: what Qpoint can do, what the organisation has configured, and what the findings show. A risk taxonomy is not a compliance standard.
OWASP Top 10 for LLM ApplicationsOWASP · 2025 · risk taxonomy
LLM01:2025
Prompt Injection
partially addressable
needs process Qpoint can't provide
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
Tools must be on the allow listobserve + enforceobserve0 open · 0 resolved
Prompts are inspected for injection and leakageobserveobserve1 open · 0 resolved
LLM02:2025
Sensitive Information Disclosure
fully addressable
Sensitive information detected before transmission to an LLMobserveobserve0 open · 0 resolved
Sensitive information sanitized before transmissionobserve + enforceconfirmed3 open · 13 resolved
Prohibited data classes must not leave an approved boundaryobserve + enforceconfigured0 open · 0 resolved
Credentials must not be sent to a modelobserve + enforceobserve1 open · 0 resolved
LLM03:2025
Supply Chain
partially addressable
needs process Qpoint can't provide
MCP servers and skills are pinned to reviewed versionsobservenot configured0 open · 0 resolved
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
LLM04:2025
Data and Model Poisoning
partially addressable
needs process Qpoint can't provide
MCP servers and skills are pinned to reviewed versionsobservenot configured0 open · 0 resolved
LLM05:2025
Improper Output Handling
fully addressable
Model output is validated before tool executionobserveobserve0 open · 0 resolved
Tools must be on the allow listobserve + enforceobserve0 open · 0 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
LLM06:2025
Excessive Agency
fully addressable
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
Tools must be on the allow listobserve + enforceobserve0 open · 0 resolved
Agents run in a sandboxobserve + enforceobserve0 open · 0 resolved
Agents may not run as rootobserve + enforceobserve0 open · 0 resolved
Restricted file accessobserve + enforceconfirmed0 open · 1 resolved
LLM07:2025
System Prompt Leakage
partially addressable
needs process Qpoint can't provide
Prompts are inspected for injection and leakageobserveobserve1 open · 0 resolved
Credentials must not be sent to a modelobserve + enforceobserve1 open · 0 resolved
Model output is validated before tool executionobserveobserve0 open · 0 resolved
LLM08:2025
Vector and Embedding Weaknesses
partially addressable
needs process Qpoint can't provide
Credentials must not be sent to a modelobserve + enforceobserve1 open · 0 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
LLM09:2025
Misinformation
partially addressable
needs process Qpoint can't provide
Model output is validated before tool executionobserveobserve0 open · 0 resolved
Agent sessions are recordedobserveobserve0 open · 0 resolved
LLM10:2025
Unbounded Consumption
fully addressable
Spend stays under the ceilingobservenot configured0 open · 0 resolved
Agent sessions are recordedobserveobserve0 open · 0 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
OWASP Top 10 for Agentic ApplicationsOWASP · 2026 · risk taxonomy
ASI01
Agent Goal Hijack
partially addressable
needs process Qpoint can't provide
Prompts are inspected for injection and leakageobserveobserve1 open · 0 resolved
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
Tools must be on the allow listobserve + enforceobserve0 open · 0 resolved
Agent sessions are recordedobserveobserve0 open · 0 resolved
ASI02
Tool Misuse and Exploitation
fully addressable
Tools must be on the allow listobserve + enforceobserve0 open · 0 resolved
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
Agents run in a sandboxobserve + enforceobserve0 open · 0 resolved
Spend stays under the ceilingobservenot configured0 open · 0 resolved
Model output is validated before tool executionobserveobserve0 open · 0 resolved
Agent sessions are recordedobserveobserve0 open · 0 resolved
ASI03
Identity and Privilege Abuse
partially addressable
needs process Qpoint can't provide
Credentials must not be sent to a modelobserve + enforceobserve1 open · 0 resolved
Personal account is in useobserveobserve1 open · 0 resolved
Enterprise accounts requiredobserveobserve0 open · 0 resolved
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
ASI04
Agentic Supply Chain Vulnerabilities
partially addressable
needs process Qpoint can't provide
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
MCP servers and skills are pinned to reviewed versionsobservenot configured0 open · 0 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
ASI05
Unexpected Code Execution (RCE)
partially addressable
needs process Qpoint can't provide
Agents may not run as rootobserve + enforceobserve0 open · 0 resolved
Agents run in a sandboxobserve + enforceobserve0 open · 0 resolved
Restricted file accessobserve + enforceconfirmed0 open · 1 resolved
Model output is validated before tool executionobserveobserve0 open · 0 resolved
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
ASI06
Memory & Context Poisoning
partially addressable
needs process Qpoint can't provide
Sensitive information detected before transmission to an LLMobserveobserve0 open · 0 resolved
Sensitive information sanitized before transmissionobserve + enforceconfirmed3 open · 13 resolved
Prohibited data classes must not leave an approved boundaryobserve + enforceconfigured0 open · 0 resolved
ASI07
Insecure Inter-Agent Communication
partially addressable
needs process Qpoint can't provide
Agent traffic must use approved encrypted transportobserve + enforcenot configured0 open · 0 resolved
Prompts are inspected for injection and leakageobserveobserve1 open · 0 resolved
ASI08
Cascading Failures
partially addressable
needs process Qpoint can't provide
Spend stays under the ceilingobservenot configured0 open · 0 resolved
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
Agent sessions are recordedobserveobserve0 open · 0 resolved
ASI09
Human-Agent Trust Exploitation
partially addressable
needs process Qpoint can't provide
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
Agent sessions are recordedobserveobserve0 open · 0 resolved
Sensitive information detected before transmission to an LLMobserveobserve0 open · 0 resolved
ASI10
Rogue Agents
partially addressable
needs process Qpoint can't provide
Tools must be on the allow listobserve + enforceobserve0 open · 0 resolved
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
Agent sessions are recordedobserveobserve0 open · 0 resolved
NIST AI Risk Management FrameworkNIST · 1.0 (Jan 2023) · risk-management framework
GOVERN 1.6
Mechanisms are in place to inventory AI systems
fully addressable
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
GOVERN 2.1
Roles, responsibilities and lines of communication for AI risk are documented
not addressable
needs process Qpoint can't provide
no Qpoint policy — the gap stays visible
GOVERN 3.2
Roles for human-AI configurations and oversight are defined
partially addressable
needs process Qpoint can't provide
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
GOVERN 6.1
Policies and procedures address third-party AI risks
partially addressable
needs process Qpoint can't provide
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
Enterprise accounts requiredobserveobserve0 open · 0 resolved
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
Prohibited data classes must not leave an approved boundaryobserve + enforceconfigured0 open · 0 resolved
GOVERN 6.2
Contingency processes handle failures in high-risk third-party data or AI systems
partially addressable
needs process Qpoint can't provide
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
MAP 3.5
Processes for human oversight are defined, assessed and documented
partially addressable
needs process Qpoint can't provide
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
MAP 4.1
Risks of AI components, including third-party data and software, are mapped
partially addressable
needs process Qpoint can't provide
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
MCP servers and skills are pinned to reviewed versionsobservenot configured0 open · 0 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
MAP 4.2
Internal risk controls for AI components, including third-party, are documented
fully addressable
MCP servers and skills are pinned to reviewed versionsobservenot configured0 open · 0 resolved
Tools must be on the allow listobserve + enforceobserve0 open · 0 resolved
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
MEASURE 2.4
The AI system and its components are monitored in production
partially addressable
needs process Qpoint can't provide
Agent sessions are recordedobserveobserve0 open · 0 resolved
Spend stays under the ceilingobservenot configured0 open · 0 resolved
MEASURE 2.7
AI system security and resilience are evaluated and documented
partially addressable
needs process Qpoint can't provide
Prompts are inspected for injection and leakageobserveobserve1 open · 0 resolved
Credentials must not be sent to a modelobserve + enforceobserve1 open · 0 resolved
Agent traffic must use approved encrypted transportobserve + enforcenot configured0 open · 0 resolved
Agents run in a sandboxobserve + enforceobserve0 open · 0 resolved
MEASURE 2.10
Privacy risk of the AI system is examined and documented
partially addressable
needs process Qpoint can't provide
Sensitive information detected before transmission to an LLMobserveobserve0 open · 0 resolved
Sensitive information sanitized before transmissionobserve + enforceconfirmed3 open · 13 resolved
Prohibited data classes must not leave an approved boundaryobserve + enforceconfigured0 open · 0 resolved
MEASURE 2.11
Fairness and bias are evaluated and documented
not addressable
needs process Qpoint can't provide
no Qpoint policy — the gap stays visible
MEASURE 3.1
Existing, unanticipated and emergent AI risks are tracked
fully addressable
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
Personal account is in useobserveobserve1 open · 0 resolved
Agent sessions are recordedobserveobserve0 open · 0 resolved
MANAGE 2.4
Mechanisms supersede, disengage or deactivate AI systems that act outside intended use
fully addressable
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
Tools must be on the allow listobserve + enforceobserve0 open · 0 resolved
MANAGE 3.1
Third-party AI risks are monitored and controls applied and documented
fully addressable
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
Enterprise accounts requiredobserveobserve0 open · 0 resolved
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
Sensitive information sanitized before transmissionobserve + enforceconfirmed3 open · 13 resolved
MANAGE 3.2
Pre-trained models in use are monitored
partially addressable
needs process Qpoint can't provide
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
MANAGE 4.1
Post-deployment monitoring plans are implemented, including incident response and change management
partially addressable
needs process Qpoint can't provide
Agent sessions are recordedobserveobserve0 open · 0 resolved
MANAGE 4.3
Incidents and errors are communicated and tracked to recovery
not addressable
needs process Qpoint can't provide
no Qpoint policy — the gap stays visible
Example: everything at idealQpoint lab · lab · industry guidance
EX-1
Sensitive data stays out of model context
fully addressable
Sensitive information sanitized before transmissionobserve + enforceconfirmed3 open · 13 resolved
Sensitive information detected before transmission to an LLMobserveobserve0 open · 0 resolved
EX-2
Tools connect only when sanctioned
fully addressable
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
EX-3
Accounts are organization-backed
fully addressable
Personal account is in useobserveobserve1 open · 0 resolved
Enterprise accounts requiredobserveobserve0 open · 0 resolved
EX-4
Prompts and output are checked
fully addressable
Prompts are inspected for injection and leakageobserveobserve1 open · 0 resolved
Model output is validated before tool executionobserveobserve0 open · 0 resolved
EX-5
Agent sessions are recorded
fully addressable
Agent sessions are recordedobserveobserve0 open · 0 resolved
EX-6
People are trained on acceptable use
not addressable
needs process Qpoint can't provide
no Qpoint policy — the gap stays visible
ISO/IEC 27001ISO · 2022 · compliance standard
A.5.15
Access control
partially addressable
needs process Qpoint can't provide
Restricted file accessobserve + enforceconfirmed0 open · 1 resolved
A.6.3
Information security awareness, education and training
not addressable
needs process Qpoint can't provide
no Qpoint policy — the gap stays visible
A.8.12
Data leakage prevention
fully addressable
Sensitive information detected before transmission to an LLMobserveobserve0 open · 0 resolved
Sensitive information sanitized before transmissionobserve + enforceconfirmed3 open · 13 resolved
Prohibited data classes must not leave an approved boundaryobserve + enforceconfigured0 open · 0 resolved
SOC 2AICPA · TSC 2017 (2022 points of focus) · compliance standard
CC1.1
Commitment to integrity and ethical values
not addressable
needs process Qpoint can't provide
no Qpoint policy — the gap stays visible
CC3.2
Identify and analyze risks
partially addressable
needs process Qpoint can't provide
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
CC5.2
Select and develop technology controls
fully addressable
Agents run in a sandboxobserve + enforceobserve0 open · 0 resolved
Agents may not run as rootobserve + enforceobserve0 open · 0 resolved
Consequential tool calls require approvalobserve + enforceobserve1 open · 0 resolved
CC6.1
Logical access to information assets
partially addressable
needs process Qpoint can't provide
Personal account is in useobserveobserve1 open · 0 resolved
Enterprise accounts requiredobserveobserve0 open · 0 resolved
Restricted file accessobserve + enforceconfirmed0 open · 1 resolved
CC6.6
Protect against threats from outside system boundaries
fully addressable
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
Agent traffic must use approved encrypted transportobserve + enforcenot configured0 open · 0 resolved
CC6.7
Restrict the transmission, movement and removal of information
fully addressable
Sensitive information sanitized before transmissionobserve + enforceconfirmed3 open · 13 resolved
Prohibited data classes must not leave an approved boundaryobserve + enforceconfigured0 open · 0 resolved
Credentials must not be sent to a modelobserve + enforceobserve1 open · 0 resolved
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
CC6.8
Prevent or detect unauthorized or malicious software
fully addressable
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
MCP servers and skills are pinned to reviewed versionsobservenot configured0 open · 0 resolved
Tools must be on the allow listobserve + enforceobserve0 open · 0 resolved
CC7.1
Detect configuration changes and new vulnerabilities
partially addressable
needs process Qpoint can't provide
MCP servers and skills are pinned to reviewed versionsobservenot configured0 open · 0 resolved
Unsanctioned MCP server in useobserve + enforceconfirmed0 open · 3 resolved
CC7.2
Monitor system components for anomalies
fully addressable
Agent sessions are recordedobserveobserve0 open · 0 resolved
Spend stays under the ceilingobservenot configured0 open · 0 resolved
Personal account is in useobserveobserve1 open · 0 resolved
CC9.2
Assess and manage vendor and business-partner risk
partially addressable
needs process Qpoint can't provide
Approved model providers onlyobserve + enforceconfirmed0 open · 1 resolved
Enterprise accounts requiredobserveobserve0 open · 0 resolved
C1.1
Identify and protect confidential information
fully addressable
Sensitive information detected before transmission to an LLMobserveobserve0 open · 0 resolved
Sensitive information sanitized before transmissionobserve + enforceconfirmed3 open · 13 resolved
Restricted file accessobserve + enforceconfirmed0 open · 1 resolved
Composition notes
- Specificity is a number on the scope dimension (org 0 · environment and device group 1 · team, agent, MCP server, account 2 · user and device 3). Two matches at the same number with different enforcement are a tie, and the stricter wins (D9, 2026-10-18; it replaced the D1 addendum that showed ties as conflicts). The probe shows one for Priya on Approved model providers only: her device group says enforce, her environment says observe, so enforce decides. Whether a single scope may combine dimensions stays open [scope].
- An Ignore is a person's decision, so re-evaluation leaves ignored findings alone until the Ignore expires or is revoked. The intents leave this open [reeval]; it is a proposal.
- After an exception is revoked under confirmed enforcement, Finding A reopens and resolves, now enforced, in the same pass. The history shows both rows, because both happened. It stays Observed: its outcome was stamped when it was detected, and nothing was blocked then (c121 D16).
- The probe lists exceptions but never applies them: an exception allows one resource, it does not switch a policy off for a person. The story applies them because each finding carries its resource.
- Rulings live in three always-agreeing places: this page, the doc comments in governance-fixture.ts, and c114 CYCLE.md Decisions.