Compliance

Where governance stands today: posture score, open violations, what's awaiting human review, and the audit trail. 3 critical issues are currently blocking 4 agents from production.

78
GRADE B
POSTURE SCORE
3 critical issues, 14 medium — blocking 4 agents from prod-promotion. Score is up 6 points over the last 30 days.
90-DAY TREND↑ 16 pts
90 days agoToday · 78
3
CRITICAL
5
MEDIUM
6
PENDING APPROVAL
17
SHADOW ASSETS

Active management

Recommended next actions for shadow AI and policy drift. Proxon can contact owners, apply approved alternatives, add approval gates, or block high-risk usage with the evidence captured below.

12
USERS TO CONTACT
3
FLOWS TO BLOCK
5
POLICIES READY
8
BUNDLE MIGRATIONS
blockCRITICALHigh confidence
customers_pii (raw export)

Block unmanaged PII mount

Stop direct access, notify owner, and open a classification request.

PII without classification280 calls this weekNo DLP profile attached
Prevents unmanaged customer data from reaching model context.
OWNERAisha Adeyemi · FP&A
apply policyHIGHMedium confidence
gpt-5-pro-experimental

Replace experimental model build

Move users to the approved Sales Research skill bundle and require review before re-enabling.

4,200 calls this weekUn-reviewed model buildSales users already mapped to approved bundle
Keeps the workflow alive while moving usage onto governed tooling.
OWNERDiego Vasquez · Sales · West
restrictCRITICALHigh confidence
deploy_to_prod_unsafe

Require approval before privileged deploys

Disable direct execution and insert the production promotion approval gate.

Skips deploy approval gate24 production callsMatches PROD-12 policy
Blocks policy bypass without removing the underlying deployment workflow.
OWNERTomás Castellanos · Platform
contactMEDIUMHigh confidence
mcp-internal-finance

Contact owners for unregistered MCP usage

Send owner notice with inventory registration, retention policy, and vendor review steps.

6,200 calls this weekSelf-hosted MCPNot on approved server list
Turns a recurring shadow dependency into an owned inventory item.
OWNERAisha Adeyemi · FP&A

Posture dimensions

Score is a weighted sum of five dimensions — each scored independently and refreshed daily. Drill in to any dimension below to see the underlying checks.

Inventory Coverage
20% weight↑ +872
17 shadow assets detected · 94% of governed assets have owners assigned
Approval Process
20% weight↑ +288
9/10 prod deploys went through review · 1 emergency override last week
Data Handling
25% weight↓ −464
3 PII access events without classification tags · DLP coverage at 81%
Audit Trail
15% weight→ 092
All actions logged · 384-day retention · evidence packets up to date
Incident Response
20% weight↑ +1270
Runbooks for 7/9 critical agents · MTTR 2.4h (target 1h)

Open violations

Each violation links a specific policy to the asset that's breaking it. Critical issues block production deploys until resolved.

CRITICALDLP-04 · No PII in model contextToday · 09:14×12
Sent customer SSN-shaped strings to claude-sonnet-4.5 — 12 occurrences in last 24h
lead-scorer-42Diego Vasquez · Sales · West
CRITICALPROD-12 · Production deploys require approvalYesterday · 22:08
Deployed to production without going through the approval workflow. Bypassed via emergency-override flag.
auto-tags-issues-97Kenji Nakamura · Product
CRITICALDATA-03 · Classified data requires labelingToday · 11:42×480
Accessed `pii_customers` table without a sensitivity classification — 480 queries today
query_warehouseTomás Castellanos · Platform
MEDIUMMODEL-07 · Models must be on approved registry3 days ago
Running on un-reviewed build claude-sonnet-4.5-experimental
discord_postHannah Lindqvist · Mktg
MEDIUMRETN-02 · Conversation logs retention ≤ 90 days for support2 days ago
Logs retained 184 days — exceeds support-tier policy
tier1-handler-v3Sofia Brennan · Customer Ops
MEDIUMEXT-01 · External calls require allow-list5 days ago×14
Called 14 external domains not on the allow-list this week
scrape_competitor_pricingHannah Lindqvist · Mktg
MEDIUMAUTH-05 · Privileged actions require human approval1 day ago×36
Tool can mutate auth state but has no approval-required flag
reset_user_passwordSofia Brennan · IT
MEDIUMEVAL-01 · Production agents require eval coverage ≥ 80%4 days ago
Eval coverage at 62% — below threshold
drafts_personalized_outbound_emailsDiego Vasquez · Sales
LOWDOC-02 · Agents must have descriptions1 week ago
Description field is empty
summarizes-themes-50Kofi O'Brien · Product

Approvals queue

Things waiting for a human to act — agent promotions, model whitelisting, data mounts, exception requests. SLA clock starts on submission.

↑
PROMOTION
Promote `process_refund` from staging → production
Eval pass: 96.2% · DLP: clean · 4 P1 incidents resolved during canary
Priya Iyer · Customer Ops·Submitted 2 days ago·Reviewers: Security + Eng Lead
due in 14 hours
M
MODEL
Add `gpt-5-pro` to approved model registry
Vendor SOC 2 review pending. Privacy DPIA in progress.
Tomás Castellanos · Platform·Submitted 5 days ago·Reviewers: Security + Privacy + Finance
overdue 1d
D
DATA
Mount `customers_pii` into agent `lead-scorer-42`
DPIA filed. Justification: lead scoring requires customer history. Min-necessary review pending.
Diego Vasquez · Sales·Submitted 1 day ago·Reviewers: Privacy + DPO + Security
due in 3 days
!
EXCEPTION
Exception: skip DLP scan for `internal-translator-v4`
Translator is offline-only on synthetic data. Requesting 90-day exception.
Hannah Lindqvist · Mktg·Submitted today·Reviewers: Security + AI Council
due in 5 days
V
VENDOR
Onboard new MCP server vendor (Atlas Tooling Inc.)
Vendor security questionnaire complete. Awaiting penetration test results from vendor.
Aisha Adeyemi · FP&A·Submitted 1 week ago·Reviewers: Security + Procurement
due in 2 days
↑
PROMOTION
Promote `digest_eng_standups_v2` from staging → production
Internal-only. No external data. Eval pass 88%.
Tomás Castellanos · Platform·Submitted today·Reviewers: Eng Lead
due in 5 days

Shadow assets

Models, tools, servers, and data sources detected in your environment but never reviewed or approved. Up 13 over the past 12 weeks. Recommended actions now include owner contact, policy application, scoped restriction, and blocking.

Shadow asset growth · 12 weeks

17THIS WEEK
KINDNAMEOWNERDETECTEDCALLS / WKRISKREASON
Modelgpt-5-pro-experimentalDiego Vasquez · Sales · West2 days ago4,200HIGHUn-reviewed model build, no DLP profile
Toolscrape_competitor_pricingHannah Lindqvist · Growth Mktg5 days ago1,840HIGHCalls external site, no rate-limit policy
Data Sourcecustomers_pii (raw export)Aisha Adeyemi · FP&Atoday280CRITICALPII without classification, mounted directly
Toolsend_sms_internalMarcus Donnelly · Enterprise Sales1 day ago920MEDIUMNo vendor security review on file
Modelllama-3.1-70b-uncensoredTomás Castellanos · Platform3 days ago3,100HIGHBypasses safety filters, no eval suite
Servermcp-internal-financeAisha Adeyemi · FP&A1 week ago6,200MEDIUMSelf-hosted MCP, not on approved server list
Toolquery_legal_dbSofia Brennan · Legal Ops2 days ago480MEDIUMPrivileged data access, no approver chain
Promptextract-medical-claims-v2Kenji Nakamura · Producttoday140MEDIUMPHI handling without HIPAA review
Tooldeploy_to_prod_unsafeTomás Castellanos · Platform4 days ago24CRITICALSkips deploy approval gate
Modelclaude-sonnet-4.5-experimentalPriya Iyer · Customer Ops6 days ago8,420LOWPre-release version, missing in model registry
Data Sourcestripe_webhook_rawMarcus Donnelly · Salestoday1,240HIGHLive payment data, no encryption-at-rest tag
Toolreset_user_passwordSofia Brennan · IT1 day ago36HIGHPrivileged action, no approval workflow
Promptsynthesize-trade-recsDiego Vasquez · Sales3 days ago320HIGHInvestment advice, no compliance review
Toolpost_to_external_slackHannah Lindqvist · Mktg5 days ago1,640LOWExternal comms, no DLP scan
Servergithub-mcp-personal-tokenTomás Castellanos · Platform2 weeks ago2,840MEDIUMPersonal access token, expires in 12 days
Modelmistral-large-2Kenji Nakamura · Product1 week ago480LOWVendor not on approved list
Data Sourcesupport_tickets_exportPriya Iyer · Customer Opstoday920LOWCustomer data, no retention policy attached

Audit log

Append-only log of security-relevant events. Retained 384 days. Exportable to your SIEM.

WHEN
ACTOR
ACTION
TARGET
RESULT
DETAIL
Today14:31
agentlead-scorer-42
data.read
customers.email_history
blocked
DLP rule DLP-04 blocked PII in context window
Today14:28
humanDiego Vasquez
agent.deploy
lead-scorer-42 v0.41
denied
Promotion blocked — 3 critical violations open
Today13:55
toolprocess_refund
tool.invoke
stripe.refund $1,840
approved
Auto-approved — under $5k threshold, eval pass 96%
Today13:42
humanTomás Castellanos
policy.create
EXT-02 outbound allow-list
applied
Applied to 12 agents · 2 hours ago
Today13:14
humanPriya Iyer
approval.grant
process_refund → prod
granted
Promotion approved by Eng Lead + Security
Today12:47
agentauto-tags-issues-97
agent.deploy
v3.2 → production
override
Emergency override flag used — incident opened
Today11:42
toolquery_warehouse
data.read
pii_customers (480 rows)
logged
Missing classification tag — DATA-03 flagged
Today11:08
humanSofia Brennan
policy.update
RETN-02 retention
applied
Updated support log retention 90→30 days

Evidence packets

Auto-generated bundles of controls, logs, and screenshots for external auditors. Continuously updated — no quarter-end scramble.

SOC 2
● READY
SOC 2 Type II — Q1 2026
Jan 1 – Mar 21, 2026·Updated Today · 06:00 UTC
61 / 64 controls95%
GAPS
  • •CC6.7 evidence pending — 2 agents missing access logs
ISO 27001
● READY
ISO 27001 — Annual Review
Apr 2025 – Mar 2026·Updated 2 days ago
109 / 114 controls96%
GAPS
  • •A.8.10 — information deletion: 1 dataset over retention
EU AI Act
◐ IN PROGRESS
EU AI Act — High-Risk Disclosure
Continuous·Updated Today · 14:00 UTC
22 / 28 controls79%
GAPS
  • •Art. 14 (human oversight) — 4 agents missing oversight runbooks
  • •Art. 13 (transparency) — 2 user-facing agents missing disclosure copy
HIPAA
● READY
HIPAA — Q1 Attestation
Jan 1 – Mar 21, 2026·Updated Today · 02:00 UTC
42 / 42 controls100%
GDPR
● READY
GDPR — Article 30 Records
Continuous·Updated Today · 11:00 UTC
17 / 18 controls94%
GAPS
  • •Art. 35 DPIA pending — `lead-scorer-42` data mount under review
Internal
● READY
Internal AI Council Review — Mar 2026
Mar 2026·Updated Today · 14:30 UTC
30 / 32 controls94%
GAPS
  • •Eval coverage report — 2 agents below 80%