Security & Governance

The Security & Governance area centralizes policy posture, compliance, security scanning, and risk for your organization. Open Security & Governance → Dashboard (/governance) for the governance control center — violations, exceptions, remediation, posture, analytics, and settings.

i Engineers who only need to fix issues on their stacks should start with My Findings under Security & Governance → My findings.
♢

Compliance score

—

Pass rate from policy and compliance posture

Healthy · Needs attention · At risk

♢

Open violations

—

Total open policy violations

Click to open the Violations tab

▣

Active policies

—

Enabled policies in scope

Jump to Analytics → policy distribution

!

Critical / high

—

Priority violations requiring review

Filtered view on the Violations tab

⌕

Findings by severity

—

Critical · High · Medium · Low

Severity strip below the hero banner

Violations Exceptions Remediation Posture Analytics Settings

Tab counts reflect live data (e.g. Violations (n), Exceptions (n), Remediation (n)). Use the menu on the dashboard to Export CSV, Export PDF, or run the Setup wizard.

Analytics — evaluation trend

On the Analytics tab, view passed, failed, and warning signals over the selected date range (7, 30, or 90 days).

Analytics — cloud & framework

Cloud distribution shows policy coverage by provider (AWS, Azure, GCP, and others). Framework coverage maps controls to CIS, NIST, ISO 27001, SOC 2, PCI DSS, HIPAA, and related frameworks.

Analytics — categories & packs

Policy distribution groups policies by governance category (Security, Operational, Cost, Networking, Identity, Compliance). Policy pack usage shows the most assigned packs. A findings trend chart breaks violations down by severity over time.

Dashboard tabs

Tab Purpose
Violations Explore open findings by stack, policy, and resource; filter by severity.
Exceptions Manage time-bound policy waivers with owner approval workflow.
Remediation Track open remediation tasks, assign owners, sync with Jira when connected.
Posture Policy coverage by cloud and stack; configure scheduled compliance re-evaluation.
Analytics Trends, framework coverage, cloud distribution, pack usage, severity history.
Settings Policy gate, live scanning defaults, audit webhook, evidence export, integrations.

Related pages

  • Security Insights — IaC scanning, live scan history, CIS dashboard
  • My findings — Engineer-focused view of findings on assigned stacks
  • Policy Packs — Install and assign curated policy bundles
  • Policy Library — Browse, evaluate, and manage individual policies
  • Compliance — Framework assessments and compliance posture
  • Risk — Security risk dashboard
  • Reports — Governance and evidence reports

Policy gate modes

Mode Deploy behavior
Enforce Blocks deployment when policies fail or the gate cannot evaluate.
Advisory Records violations but does not block deployment.
Fail-open Blocks on enforcing violations; evaluation engine errors allow deploy with warnings.
ⓘ   The policy gate runs during PLAN and APPLY for pre-deployment validation. Enable per-environment gates in Settings to override the org default by environment type (e.g. Production vs Development).

Settings checklist

  • Set the org-wide policy gate mode and optional per-environment overrides.
  • Enable live scanning defaults for new repositories (scanner, severity threshold, runner options).
  • Configure the audit webhook for governance-category audit events (JSON POST).
  • Schedule compliance evidence export to a delivery webhook under Settings → Evidence delivery.
  • Review unified schedules for evidence export, compliance assessments, and related jobs.
  • Connect change management (e.g. Jira) under Administration → Integrations → Change Management.
Evidence delivery: Scheduled evidence bundles are delivered via webhook (HTTP POST). Email and S3 delivery may log intent until outbound mail and object-store credentials are configured in Administration. Jira and other ITSM links are managed under Integrations.

Permissions

Permission / role Typical access
governance:manage or org Admin/Owner Full dashboard, settings, pack assignment, governance administration
policy:manage Manage own policy packs; act on findings within scope
security:manage Resolve or suppress findings and update remediations
Viewers Read-only access to dashboards and findings