Compliance
Cloud & Enterprise · Team plan and up
Compliance turns your governance activity into audit-ready reports. It draws evidence from
the activity ledger, so every report is backed by the tamper-evident
record. It ships in the commercial edition (ee/compliance, gated by audit_ledger).
Reports
Generate a report against a framework:
- SOC 2
- EU AI Act
- NIST AI RMF
Each report lists its controls, a status per control, and the evidence drawn from the ledger. Because the evidence comes from the hash-chained ledger, each report carries a ledger-verified badge reflecting the chain verification result. Reports export as JSON or CSV.
Policy dry-run
The policy dry-run answers "what would the live policy set decide?" without enforcing anything — you submit a request and see how the current policies would evaluate it. Use it to validate policy changes before they take effect.
Endpoints
| Method | Path | Purpose |
|---|---|---|
POST | /v1/compliance/reports | Generate a report. |
GET | /v1/compliance/reports | List generated reports. |
GET | /v1/compliance/reports/{id}?format=csv | Fetch a report (add ?format=csv for CSV; JSON otherwise). |
POST | /v1/compliance/verify-ledger | Verify the ledger chain for the ledger-verified badge. |
POST | /v1/compliance/policies/dry-run | Evaluate a request against the live policy set without enforcing. |
Next steps
- Activity ledger — the evidence source and chain verification.
- Policy engine — the policies a dry-run evaluates.
- Governance overview — the pillar in full.