Compliance you can prove
Compliance is not a separate audit — it is a property of how work already flows: findings cite real controls, a posture scan grades the codebase, and the immutable governance trail becomes the evidence.
How it works
On each proposal, the compliance agent checks the diff against the frameworks a tenant enables and cites the exact control every finding touches — advisory by default, or an opt-in hard-gate that raises the required approver for a high or critical finding.
A posture scan sweeps the repository against HIPAA and GDPR code-checkable controls, returning a pass / gap / unknown report — never a fabricated pass — with each gap fileable as a remediation work item by a human.
The event log maps to SOC2 controls and freezes each audit period into a tamper-evident, write-once snapshot — coverage-honest, exportable, and marking anything it cannot attest as "manual evidence required" rather than claiming it.
The agents behind it
Human control
Nothing is auto-enforced without opt-in: findings annotate the gate, an optional hard-gate escalates the approver (it never blocks), and evidence is a read-only projection — a human always decides, and the immutable trail records that they did.