Compliance & assurance
Audited against every standard that takes “no” seriously.
Most compliance pages are a 40-page PDF gated behind a work email and a 30-minute discovery call. Ours is the actual evaluation order of the policy engine—and it never asks why you withdrew.
Scenes & Operations Control
Type II means we checked twice: once in writing before the window opened, and once out loud before the critical scope fired. 'We talked about it last month' is a major audit finding.
Freely given · Reversible · Informed · Enthusiastic · Specific
ISO 27001 for people who negotiate first: no coercion or sobriety waivers, <1ms revocation, explicit scope allowlists, fresh step-up checks, and zero role inheritance.
Moderate & High-Impact Baseline
Any contact.restraint or impact scope above baseline requires an attached Dungeon Monitor (dm-02) with read_write_emergency and a verified release plan.
*Partner Consent Integrity
We never store 'prepaid consent' at rest. Tokens expire with the window, missed heartbeats fail closed, and there is no 'remember this partner for 30 days' checkbox.
Historical consent is an audit log entry, not a live credential. Re-affirm in the current window.
| id | control | engine implementation |
|---|---|---|
| CC6.1 | Least privilege & scope narrowing | Proposals grant nothing; counterparties can only narrow scopes and timers, never widen mid-window. |
| CC6.2 | Short-lived credentials (no 'vibes' caching) | Every session token is time-boxed (15m–480m) with a dead-man switch on missed heartbeats. |
| CC6.3 | Unconditional revocation (GDPR Art. 7) | POST /v4/revocations has no reason field in its schema and propagates globally in <1ms. |
| CC7.4 | Incident & aftercare SLA | Every closed or revoked session opens an obligatory aftercare window (p95 4m on Coven). Unmet aftercare is a Sev-1. |
| P4.1 | Hard-limit confidentiality | Hard limits are never disclosed as a list of weaknesses; they compile as immutable deny rules evaluated before any allow. |