On-Demand Auditing

Compliance answers from signed facts, on demand.

Try On-Demand Auditing Free Request a Demo

Provenance Governor package view showing gate topology, dependency compliance score, and vulnerability deductions.

Feature overview

On-Demand Auditing

Ask any question about an artifact's compliance and get an answer from signed facts immediately. Which dependencies does this artifact carry? Did it pass every gate? When was it last evaluated? Answers trace to signed records at every gate, not logs or scanners. Fact Connectors and Fact Evaluators extend answers beyond the build to include deployment events, IT Service Management (ITSM) tickets, and live vulnerability status. Your policies define what compliance means. The EU Cyber Resilience Act and US Executive Order 14028 require per-package supply chain answers.

Works great with

Artifact Governance

Answer any supply chain question on demand

Trace any artifact's compliance from its signed facts.
Each answer is grounded in signed attestations recorded at every gate.
Reconstruct what was known at decision time, including the policy evaluation and recommended action.

Learn how policies are evaluated

Confident answers from the full delivery lifecycle

Audit answers include deployment events, ITSM tickets, and CD pipeline signals fed through Fact Connectors.
Answers reflect live data from vulnerability databases, approval workflows, and change management systems, not just build-time snapshots.
Answers span signed facts from the full delivery lifecycle.

Set up CI/CD integration

Governance

Compliance answers an auditor can verify

Answers resolve to signed attestation records an auditor can trace to the original gate evaluation.
Your policies decide each answer, so the rules you write are the rules enforced at every gate.
Meet EU Cyber Resilience Act and US Executive Order 14028 requirements with per-package supply chain answers.

View the verification summary format

Agent Context

AI agents act on verified compliance context

Investigate compliance risk and triage vulnerabilities across dependencies, toolchains, and build tools.
Get accurate remediation recommendations through progressive disclosure, with upgrades defaulting to patch-level and tunable per package pattern.
Limit each actor to only the artifacts and gates they need through fine-grained authorization.
RoadmapTrace a vulnerability's blast radius across the organization to identify every affected artifact and gate.

View the MCP tools