Control mappings
Every governed action leaves customer-owned evidence: normalized events, policy decisions, human approvals, tamper-evident exports.
SR 11-7 · FFIEC · DORA · EU AI Act · ISO 42001 · SOC 2 — see each mapping below.
Evidence, not attestations
Each mapping below is built from artifacts your auditor can open and verify.
Normalized agent events
Every tool and model call, one schema across vendors.
Policy decisions
Allow, confirm, or block, recorded with the rule that fired.
Human approvals
Who approved what, with rationale and timestamps.
Append-only audit log
Hash-chained records that cannot be silently rewritten.
Intent Fidelity evidence
What was asked, bound to what the agent actually built.
Provenance queries
Audited answers to “which sessions touched this change?”
PR merge evidence
The decision record inside the PR reviewers already read.
Evidence packages
Tamper-evident exports your auditor can verify offline.
Control mapping
Each mapping names what the artifacts cover today and what you still validate in your environment.
SR 11-7
Documented intent, review, and exceptions, with risk monitored over time — not at one approval point.
Evidence produced
Still to validate
Model-inventory linkage, independent validation, and model-risk owner signoff in your environment.
FFIEC
Every change traces to its agent; every sensitive action to an actor, a policy, and an outcome.
Evidence produced
Still to validate
IAM integration, live identity mapping, and a validated deployment inside your own cloud.
DORA
Controlled changes, approvals that deny when review is unavailable, and a clear view of reliance on outside agents.
Evidence produced
Still to validate
Full deployment automation, customer-environment validation, live connector proof, and resilience runbooks.
EU AI Act
Demonstrable human oversight: approvals on record, unrewritable logs, documented risk decisions.
Evidence produced
Still to validate
Legal classification, role-specific human-oversight procedures, and retention-policy alignment.
ISO 42001
An AI management system needs defined roles, risk controls, monitoring, and traceable records.
Evidence produced
Still to validate
Formal AI management-system procedures, completed control-owner matrices, and an approved trust-score use policy.
SOC 2
The same questions as human code: authorized by whom, tested how, traceable to what record.
Evidence produced
Still to validate
CI and ticketing integration, and live deployment attestations.
AutoDevOps produces the evidence; the opinion belongs to your auditor. Customer-cloud validation of AutoDevOps itself is still open in every mapping above.
Policy, approvals, audit, and a tamper-evident evidence package on the validated AWS path.