Cloud Evidence That Actually Evaluates
Collecting evidence was never the hard part. Producing a verdict you can defend is.
This release connects the last link in that chain. Every integration operation now decodes its own response, evaluates its assertions, and writes a real verdict against the control — and the failure modes that used to resolve silently in your favor no longer do. An AccessDenied used to arrive as evidence with zero records, which made a "no critical Security Hub findings" check pass. XML from IAM, EC2, and S3 was never decoded, so those checks were reading an empty array. A relative-date predicate compared ISO strings against the literal text CUTOFF_PLACEHOLDER. Each of those failed by attesting a control rather than by erroring, which is the only kind of bug that matters here.
Now an undecodable response fails its region, empty evidence returns inconclusive and attests nothing, an incomplete sync run is excluded from coverage, and every failing check raises a finding with the evidence attached.
The connector estate grew to match. AWS sync spans multiple accounts, multiple regions, and AWS Organizations — fanning out with per-account failure isolation, stamping every record with its account and region, and offering chained role access for estates that will not run StackSets. Supabase, Vercel, Netlify, and GitHub cover the teams whose production footprint is a PaaS stack, where hosting, database, and deploy pipeline previously produced no automated evidence at all.
- Approved exceptions can satisfy a check — pointed at specific records, requiring a real approver, and expiring on their own, so an accepted risk is not a permanent carve-out
- Agent skills bundle instructions, tools, and when-to-use guidance, loading on demand instead of on every turn, with provenance-aware approvals and asynchronous sub-agents
- Programs report against individual boundaries, with account and region scope rules that finally make the PCI CDE case reachable
- Assessments scoped to a program inherit its controls and every piece of evidence already on file
- A desktop app with tabs, persisted per workspace and reorderable by drag
- AI spend attributed by surface and operation, with a usage report that reconciles itself
- CSP enforced, privileged RPCs behind the service role, and a security pass that closed every advisor finding
Open Signup, PCI DSS, and Agent-Run Vendor Reviews
The waitlist is gone — anyone can sign up. Plus full-fidelity PCI DSS ROC & SAQ assessments, an agent that runs the vendor evidence lifecycle over email, trust centers served at your own domain root, and an evidence-backed assurance dashboard.
Agent-first GRC: what changes when AI runs the program
Most GRC tools added AI as a feature. Agent-first GRC treats agents as the operator — drafting policies, answering questionnaires, and running the program with humans approving the work that matters.