Compliance & Traceability Methodology

Every compliance claim traces to a written requirement, a capability specification with WHEN/THEN scenarios, an implementation pointer, and a dated, executed test or acceptance script. The compliance matrix is generated directly from this evidence map, and continuous integration re-validates the chain on every relevant change.

The traceability chain

%%{init: {"theme": "base", "themeVariables": {"fontFamily": "-apple-system, Segoe UI, Helvetica, Arial, sans-serif", "primaryColor": "#eef2f7", "primaryTextColor": "#0b0b0b", "primaryBorderColor": "#5b6b7c", "lineColor": "#5b6b7c", "secondaryColor": "#eef4ff", "tertiaryColor": "#f4f3f0", "clusterBkg": "#f9f9f7", "clusterBorder": "#c3c2b7", "edgeLabelBackground": "#fcfcfb", "actorBkg": "#eef2f7", "actorBorder": "#5b6b7c", "actorTextColor": "#0b0b0b", "actorLineColor": "#5b6b7c", "signalColor": "#52514e", "signalTextColor": "#0b0b0b", "labelBoxBkgColor": "#eef4ff", "labelBoxBorderColor": "#5b6b7c", "labelTextColor": "#0b0b0b", "loopTextColor": "#0b0b0b", "noteBkgColor": "#fdf3d9", "noteBorderColor": "#c98500", "noteTextColor": "#3d2f00", "activationBorderColor": "#5b6b7c", "activationBkgColor": "#eef4ff", "sequenceNumberColor": "#ffffff"}}}%%
flowchart LR
    Req["Written requirement"] --> Cap["Capability specification\n(WHEN/THEN scenarios)"]
    Cap --> Impl["Implementation\n(file:line pointer)"]
    Impl --> Test["Test or acceptance script"]
    Test --> Evidence["Dated, executed evidence"]
    Evidence --> Matrix["Generated compliance matrix"]

A requirement is marked "Yes" when a dated, successfully-executed test or acceptance script backs it end to end.

What a typical requirement set for this product category covers

Grouped by theme:

Architecture & security

• Enforcement delivered as compiled binaries, with interpreted languages excluded from the core masking/interception path.
• Fail-closed behavior when a policy signature or protection-core health check fails.
• Zero-knowledge processing — detection and masking happen locally.
• Kernel/OS-level, context-aware file-access control.

Functional capability

• Command-line interception across the shells used by developers and AI agents (bash, zsh, PowerShell, cmd.exe).
• A proxy for AI-agent tool protocols (e.g. MCP) that masks sensitive values in responses while preserving the protocol.
• Resident clipboard protection.
• A local, offline sensitive-data detector combining structural, statistical, and dictionary-based methods, as described in Detection Engine.
• A no-code policy authoring interface.
• A local, high-throughput secret scanner across many repositories.
• Measurable detector quality (false-positive/false-negative rates) with a calibration mechanism.

Integration & infrastructure

• Fully on-premise/air-gapped deployment.
• Standards-based SSO (OIDC) with role mapping.
• Direct integration with an existing SIEM/log pipeline.
• A read-only auditor/viewer role.
• Silent, MDM/SCCM-compatible mass deployment.

Continue to Glossary.