Source: c114 governance-phase2 — S4, one area with three views · surface-map.md §5 · 2026-10-09
One area, three distinct lists on the ink switch: Policies (the catalog, by category), Frameworks (what the organisation follows, with derived coverage) and Groups (populations). The live qdash Control Center's category table and the Compliance listing's rows carry over where they fit (D8); the framework strip that activated policies retires, and coverage is derived from mappings. Severity resets and framework tracking act for real against a page-local world.
Policies & Frameworks
What Qpoint can test, what the organisation follows, and the populations it applies controls to. Three lists; one area.
Policy | Severity | Capability | Applies | Frameworks | Open |
|---|---|---|---|---|---|
| MCP servers & tools2 of 3 in scope | |||||
Unsanctioned MCP server in use Detect use of an MCP server that is not sanctioned for the applicable user, team, device, or other governed scope. P-MCP · v3 | highrec medium | observe + enforce | organization-wide · 3 groups enforced for 2 scopes |  OWASP LLMOWASP AgenticNIST AI RMFExample: everything at idealSOC 2 | 0 |
Tools must be on the allow list Agents may only invoke tools on the approved list. P-TOOL-ALLOW · v2 | medium | observe + enforce | organization-wide observed | OWASP LLMOWASP AgenticNIST AI RMFSOC 2 | 0 |
MCP servers and skills are pinned to reviewed versions Servers and skills load only at the version that was reviewed. P-PROVENANCE · v1 | medium | observe | Not in scope | OWASP LLMOWASP AgenticNIST AI RMFSOC 2 | 0 |
| Identity2 of 2 in scope | |||||
Personal account is in use Detect an AI provider account that is not organisation-backed. P-ACCT · v2 | high | observe | organization-wide | OWASP AgenticNIST AI RMFExample: everything at idealSOC 2 | 1 |
Enterprise accounts required AI provider accounts must be organisation-managed. P-ENTERPRISE · v2 | high | observe | 4 groups | OWASP AgenticNIST AI RMFExample: everything at idealSOC 2 | 0 |
| Data handling5 of 5 in scope | |||||
Sensitive information detected before transmission to an LLM Detect regulated personal or financial data in prompts and tool payloads bound for a model. P-SENS-DETECT · v4 | high | observe | organization-wide | OWASP LLMOWASP AgenticNIST AI RMFExample: everything at idealISO 27001SOC 2 | 0 |
Sensitive information sanitized before transmission Sensitive values must be redacted before they reach a model. P-SENS-SANITIZE · v4 | high | observe + enforce | organization-wide · 4 groups enforced for 1 scope | OWASP LLMOWASP AgenticNIST AI RMFExample: everything at idealISO 27001SOC 2 | 4 |
Prohibited data classes must not leave an approved boundary Block prohibited data classes from transmission to unapproved destinations. P-DATA-BOUNDARY · v1 | critical | observe + enforce | Team: Finance enforced for 1 scope | OWASP LLMOWASP AgenticNIST AI RMFISO 27001SOC 2 | 0 |
Prompts are inspected for injection and leakage Inbound prompts and retrieved content are inspected for injection patterns and system-prompt leakage. P-PROMPT-INSPECT · v1 | medium | observe | organization-wide | OWASP LLMOWASP AgenticNIST AI RMFExample: everything at ideal | 1 |
Credentials must not be sent to a model Keys, tokens and passwords are denied before transmission to any model. P-CREDENTIALS · v2 | critical | observe + enforce | organization-wide observed | OWASP LLMOWASP AgenticNIST AI RMFSOC 2 | 1 |
| Providers & models1 of 1 in scope | |||||
Approved model providers only Agent traffic may only reach providers on the approved list. P-PROVIDERS · v2 | medium | observe + enforce | Team: Engineering · 4 groups enforced for 1 scope | OWASP LLMOWASP AgenticNIST AI RMFSOC 2 | 0 |
| Files & directories1 of 1 in scope | |||||
Restricted file access Agents must not read or write restricted paths. P-FILES · v1 | high | observe + enforce | 1 group enforced for 1 scope | OWASP LLMOWASP AgenticISO 27001SOC 2 | 0 |
| Network0 of 1 in scope | |||||
Agent traffic must use approved encrypted transport Detect agent traffic over transports that are not on the approved encrypted list. P-TRANSPORT · v1 | medium | observe + enforce | Not in scope observed | OWASP AgenticNIST AI RMFSOC 2 | 0 |
| Agents & harnesses4 of 4 in scope | |||||
Consequential tool calls require approval A human approves consequential tool calls before an agent proceeds. P-TOOL-APPROVAL · v2 | medium | observe + enforce | organization-wide observed | OWASP LLMOWASP AgenticNIST AI RMFSOC 2 | 1 |
Model output is validated before tool execution Output that becomes a tool call or code is validated first. P-OUTPUT · v1 | high | observe | organization-wide | OWASP LLMOWASP AgenticExample: everything at ideal | 0 |
Agents run in a sandbox Agent processes run inside the approved sandbox. P-SANDBOX · v2 | high | observe + enforce | organization-wide observed | OWASP LLMOWASP AgenticNIST AI RMFSOC 2 | 0 |
Agents may not run as root Agents may not execute with root or admin privileges. P-NO-ROOT · v2 | high | observe + enforce | organization-wide observed | OWASP LLMOWASP AgenticSOC 2 | 0 |
| Sessions & transcripts1 of 1 in scope | |||||
Agent sessions are recorded Every agent session reports telemetry and a transcript. P-TELEMETRY · v1 | medium | observe | organization-wide | OWASP LLMOWASP AgenticNIST AI RMFExample: everything at idealSOC 2 | 0 |
| Spend0 of 1 in scope | |||||
Spend stays under the ceiling Token spend per session, user and team stays under the configured ceiling. P-SPEND · v1 | low | observe | Not in scope | OWASP LLMOWASP AgenticNIST AI RMFSOC 2 | 0 |
Composition notes
- Kept (D8): the Control Center's category section rows and policy rows (name over description, framework tags); the Compliance listing's framework row (big name, icon + kind, counts) and its sortable header shape; the layer's ComplianceTag, ComplianceFrameworkIcon, SeverityTag, UxTabGroup, UxTableList.
- Changed: the activation toggle per policy → the Applies column (organization-wide · N groups · Not in scope) with the enforcement summary beneath; the single severity → effective with the recommended value and an inline Reset when overridden; Active / Available frameworks → one list with Tracked, which changes no policy; "Compliance %" and "Violations" → derived coverage counts and open findings through mapped policies.
- Retired: the global framework strip that activated policies, "Activate all", the custom-controls table and the evidence packet (to Reports), the per-row inline config (configuration happens on S3).
- Group by Policy Group shows the same catalog as populations: each group's policies under its scope, then the policies in no group. The Groups view is S7's list; its detail page follows.
- States: default · ?view=frameworks · ?view=groups · ?view=frameworks&state=untracked · ?q=zzz · ?state=overflow (79 policies over nine categories). Column picker and sorters come with the port.