This preview is password protected.
| Severity | Finding | POA&M | Due | Status |
|---|---|---|---|---|
| S1 | Off limits zone access. A scheduling helper's estate touched the HR records lake, a RED zone. Access revoked at the dataset (kill switch layer 2, scoped), attestation suspended, data taken treated as an incident. | POAM-001 · AC-3 | 30 days | Contained, remediation open |
| S2 | Governed agent drift. The invoice agent gained a new endpoint (api.mistral.ai) outside its attested configuration. Change was legitimate; attestation reissued after review. | POAM-002 · SI-4 | 90 days | Closed this week |
| S3 | Candidate agent. Endpoint artifacts suggest a personal automation on one laptop (heartbeat file, no schedule, no provider traffic). Owner interview scheduled; not counted as undeclared. | POAM-003 · CM-8 | 180 days | Triage |
Response performance this month: S1 responded in 22 minutes against a 30 minute Managed target. Published in the monthly service report either way.
Zones are enforced at design, at attestation, and at detection. Zone changes require your data owner's approval and are ledger recorded.
Verdict: DELIVERING. Baselines were recorded in the Design Sprint, so the proof was designed in, not reconstructed.
All reports are generated from the platform's ledger backed record, so any figure can be traced to its evidence.