Evidence-producing controls
Tenant membership, RBAC decisions, API changes, signed deployments, rollback, and account administration create durable audit events. Migrations and releases retain checksums.
Operator responsibilities
Access review, host encryption, off-host backup, log retention, incident response, data classification, vendor management, uptime monitoring, and jurisdiction-specific requirements remain deployment responsibilities.
Current limitations
There is no certification report, automated control mapping, legal attestation, or complete policy library in the current release.