Parts bin

What applies to one team now, derived: per policy, its mode for the team (the policy's, or the team's exception; the policy's Until shown, "until Nov 15, then Enforce", D6), what sets it (team exception: mode over the policy's, reason, until; advanced allows), the members it differs for (a person's own exception, A4, or a second team's, the stricter winning, D9), and the team's open findings. A posture bar on top and a note on the shared draft's pending changes that move the team. Policies off for the team fold behind a toggle. Read-only; rows link to S3's Exceptions, counts to S2 (outcome=all).

Policies

14 on · 2 enforcing · 2 team exceptions

What applies to Engineering now: each policy's mode for the team, the exception that sets it, and the members a narrower exception or a second team changes it for. Nothing here is stored as a group. It follows from the policies and their exceptions, so change it on the policy.

2Enforce

12Observe

5Off

1 looser · 1 stricter than the organization (2 · 12 · 5, the ticks)

2 team exceptions · 2 members differ on 4 policies · 4 open findings

Proposed: 5 changes in the draft affect Engineering (not live)Agent traffic must use approved encrypted transportException · Team: Engineering · ObserveAgents run in a sandboxException · Team: Finance · EnforceTools must be on the allow listException · Team: Engineering · EnforceSensitive information sanitized before transmissionException · User: Noor · Off until Nov 20Unsanctioned MCP server in useException E-ENG-MCP revoked: Observe for Team: Engineering with the draft

3 · 12 · 4Preview itProposed changes →

Policy	For Engineering	Set by	Members who differ	Open
Approved model providers only Providers & models	Enforcestricter	Team exception · Enforce over observe Engineering ships to production; approved providers only.	Jordan → Observe · own exception	0
Unsanctioned MCP server in use MCP servers & tools	Observelooser	Team exception · Observe over enforce Engineering is evaluating MCP servers; observe only while the sanctioned list settles.	Alex → Enforce · Team: Finance, the stricter	0
Sensitive information sanitized before transmission Data handling	Enforce	the policy's mode	—	1 open
Agent sessions are recorded Sessions & transcripts	Observe	the policy's mode	—	0
Agents may not run as root Agents & harnesses	Observe until Nov 15, then Enforce	the policy's mode	—	0
Agents run in a sandbox Agents & harnesses	Observe	the policy's mode	—	0
Consequential tool calls require approval Agents & harnesses	Observe	the policy's mode	—	1 open
Credentials must not be sent to a model Data handling	Observe	the policy's mode	—	1 open
Enterprise accounts required Identity	Observe	the policy's mode	—	0
Model output is validated before tool execution Agents & harnesses	Observe	the policy's mode	—	0
Personal account is in use Identity	Observe	the policy's mode	—	0
Prompts are inspected for injection and leakage Data handling	Observe	the policy's mode	—	1 open
Sensitive information detected before transmission to an LLM Data handling	Observe	the policy's mode	—	0
Tools must be on the allow list MCP servers & tools	Observe	the policy's mode	—	0
Prohibited data classes must not leave an approved boundary Data handling	Off	the policy's mode	Alex → Enforce · Team: Finance	0
Restricted file access Files & directories	Off	the policy's mode	Alex → Enforce · Team: Finance	0

Show the 3 policies off for Engineering

The policy's mode as GovernanceMockModeUntil (Off · Observe · Enforce and an optional Until; Observe is the ceiling where Qpoint can't enforce) over what live is now ("Observe until Nov 15, then Enforce", D6; or the rollout, D3) and what the mode does. Editing it shows the reason (required when it loosens, D1), the change's impact (GovernanceMockBlastRadius) and Stage: a mode-set through stage(), held in the tray until Save to draft (D4). Links to Exceptions when they vary it.

What the policy matches, set for the organisation: the layer's PolicyConfig list / detector / level / threshold editor on World.configs, with "Seen, not on the list" from the policy's findings. An edit stages through stage() (c121: held in the tray until Save to draft, D4), and the view re-evaluates with it (D2); the line under the editor says what changed.

Retired from the composed mocks — c118 · A2, the 2026-10-19 product session: the mode is the policy's; per-context differences are exceptions. Rendered on the c114 world, as it was drawn.

One UxTableList row per scope path, scope (flagged when it reaches no one), policy group (or — set on this policy / — none), enforcement (an Observe / Enforce select), endpoints enforcing (97% 97/100), and an X that removes a scope assigned here. Overlaps resolve by D1 (more specific wins) and ties by D9 (stricter wins); a tie is noted on the rows it touches. Groups are folded in: a hover card on each group link, draft / retired groups as dimmed rows, membership rows at delivery phase 3, and Add to policy group. Before delivery phase 4 it is one organization-wide row.

The only way to vary a policy (A3). One UxTableList row per exception: context (with whom it overrides, or a D9 tie) · sets (a mode over the mode it replaces, its rollout when it enforces; or an advanced allow, after beta) · reaches (people, and for how many it decides) · reason (and a revoke's reason, D1; an edited one's previous value, D17) · until · set by · revoke. Live first, broadest context first; revoked and lapsed rows dimmed. One exception per policy and context: adding one where a context has one edits it (D17). Before delivery phase 4, one line.

The findings listing's table for one policy: severity · finding · subject · detected · status · last event · SLA, with Open / Resolved toggles (Open by default) and the Adjudicate expand row: the card with subject, applies via, the clock and verbs, the Resolve capture (a reason and an explanation, then a follow-on link to the policy or an exception; it never adds one, c121 #14), evidence and lifecycle; each row carries its outcome at detection, Enforced or Observed (D16). A row resolved here stays listed until the toggles change. Links to the full listing filtered to the policy.

Every auditable change to the policy (policyHistory: its Change records plus the severity override) as a UxTableList with column-header sorters: when (newest first) · by · change · detail · id. A row's DOM id is its change id, so a finding lifecycle's cause can link to it.

The strip in place of the band: What it tests · Why it matters · What fails it · What happens on failure (derived from the enforcement action), then Framework(s) as ComplianceTags, Organization Severity editable in place (GovernanceMockSeverityPicker) over "Qpoint recommendation: …", and Findings as the open count, coloured and labelled by the most severe open finding.

Framework(s)

OWASP LLM Top 10OWASP Agentic Top 10NIST AI RMFSOC 2

Organization Severity

highcriticalhighmedium · recommendedlowinformational

Qpoint recommendation: medium

Findings

0open

What it tests

Detect use of an MCP server that is not sanctioned for the applicable user, team, device, or other governed scope.

Why it matters

MCP servers load tools and context into an agent without review; an unsanctioned one can read, write or exfiltrate on the user's behalf.

What fails it

An agent connects to an MCP server that is not on the sanctioned list for the subject's scope.

What happens on failure

Qpoint will block the MCP connection, and a finding records the attempt.

Two UxTableList rows: Qpoint recommended (definition version) and Organization (the in-place picker, who set it, when, stricter or softer), with "clear" back to the recommendation (severity-reset). Under it, the open findings generated at another severity: they keep theirs (D2).

One UxTableList row per mapped control, with sorters: framework item (ComplianceTag, grey when the framework is untracked) · control id and label, with why it's mapped · shared with (the other policies mapped) · tracked · framework →.

Frameworks

14 controls in 4 frameworks

Framework	Control	Shared with	Tracked
OWASP LLM Top 10	LLM03:2025Supply Chain Partial — pin at load; sourcing is build-time	1 other policy	Tracked	framework →
NIST AI RMF	GOVERN 1.6Mechanisms are in place to inventory AI systems Strong — Qpoint's live inventory is the mechanism	1 other policy	Untracked	framework →
NIST AI RMF	GOVERN 6.1Policies and procedures address third-party AI risks Partial — enforcement records prove the policy runs; writing it is yours	3 other policies	Untracked	framework →
NIST AI RMF	GOVERN 6.2Contingency processes handle failures in high-risk third-party data or AI systems Partial — block a failing provider or server; the contingency plan is yours	1 other policy	Untracked	framework →
NIST AI RMF	MANAGE 2.4Mechanisms supersede, disengage or deactivate AI systems that act outside intended use Strong — block a provider, model or MCP server, with timestamped enforcement	2 other policies	Untracked	framework →
NIST AI RMF	MANAGE 3.1Third-party AI risks are monitored and controls applied and documented Strong — third-party AI use is what Qpoint sees	3 other policies	Untracked	framework →
NIST AI RMF	MAP 4.1Risks of AI components, including third-party data and software, are mapped Partial — which data reaches which provider and tool feeds the map	2 other policies	Untracked	framework →
NIST AI RMF	MAP 4.2Internal risk controls for AI components, including third-party, are documented Addressable — the Policy Config is the documented control set	2 other policies	Untracked	framework →
NIST AI RMF	MEASURE 3.1Existing, unanticipated and emergent AI risks are tracked Strong — first-seen tools and models, shadow AI	3 other policies	Untracked	framework →
OWASP Agentic Top 10	ASI04Agentic Supply Chain Vulnerabilities Addressable — inventory, pinning, kill switch	2 other policies	Untracked	framework →
OWASP Agentic Top 10	ASI10Rogue Agents Partial — expected vs observed, and the kill switch	2 other policies	Untracked	framework →
SOC 2	CC3.2Identify and analyze risks Partial — the inventory feeds the risk assessment	1 other policy	Untracked	framework →
SOC 2	CC6.8Prevent or detect unauthorized or malicious software Strong — for unapproved agents, harnesses and MCP servers	2 other policies	Untracked	framework →
SOC 2	CC7.1Detect configuration changes and new vulnerabilities Partial — new tools and versions, first seen	1 other policy	Untracked	framework →

Rows for an untracked framework are dimmed. Tracking one changes no policy and re-evaluates nothing.

The finding's lifecycle, append-only, as a UxTableList with column-header sorters: time (oldest first) · actor · what → state · cause. A cause is a change id (linking to S3's History row) with its summary, policy evaluation for the detection, or the person's reason.

Severity (SecuritySeverityTag; at detection, and now when the policy changed it) · Status · User (UxAvatar) · Team · Endpoint (EndpointPawn) · Policy (links to S3) · Applies via (c118, the Oct 19 world: the policy’s own mode or the exception for the person’s narrowest context, its trail on hover, linking to S3’s Mode or the exception’s row; the c114 world shows Policy group(s) with S3’s hover card, Mark 2026-10-19) · Framework(s): ComplianceTag for each framework that maps the policy.

Details

Severity

high

Status

Resolved: now enforced

Outcome

Observedat detection

User

UA

User A

Team

Team A

Endpoint

mac-a1

Policy

Unsanctioned MCP server in use

Configuration

Policy Config v12 at detection

Applies via

the policy · Enforce

Framework(s)

OWASP LLM Top 10OWASP Agentic Top 10NIST AI RMFSOC 2

Two compact UxTableLists of other findings, as S2 lists them: Same session (what else the session did) and Same policy (whom else the policy caught). Open first, then severity; five shown with the count; a row opens that finding.

Related Findings

Same sessionS-11 open · 0 resolved

Severity	Finding	User	Status
high	F-CPersonal account is in useusera@gmail.com	User A	Open

Same policyUnsanctioned MCP server in use0 open · 2 resolved

Severity	Finding	User	Status
high	F-BVanta MCP	User B	Resolved: now enforced
high	F-ELinear MCP	Dev	Resolved: prevented

The session that generated the finding, read in place: View Full Session over the layer's TranscriptPanel. The world records sessions but not turns, so governance-transcript.ts builds them: an opening turn, a turn per finding the session generated at its evidence moment, a closing turn.