Governance Dashboard
Open Security & Governance → Dashboard for the org-wide governance control center: compliance posture, policy violations, exceptions, remediation, analytics, and settings. Requires governance:read (org Admin/Owner or users with governance read access).
Engineers who only fix issues on their stacks should use My findings instead of the full dashboard.
Page layout
| Area | What it shows |
|---|---|
| Quick actions | Review violations (when any exist), Run IaC scan, Manage policies, Policy packs. |
| Filters | Date range (7 / 30 / 90 days), cloud provider (All, AWS, Azure, GCP, OCI, DigitalOcean), framework (All, CIS, NIST, ISO 27001, SOC 2, PCI DSS, HIPAA). |
| Hero banner | Compliance score with posture status (Looking good / Needs attention / At risk), open violations, active policies, critical/high count. |
| Severity strip | Critical, high, medium, and low violation counts with link to the Violations tab. |
| Recommended next steps | Contextual suggestions (e.g. review violations, manage exceptions, run scans). |
| Main tabs | Violations, Exceptions, Remediation, Posture, Analytics, Settings — tab labels show live counts where applicable. |
Use the header ⋮ menu to Export CSV (KPI snapshot), open the Setup wizard, or Export PDF (browser print). The refresh button reloads all dashboard data.
Hero KPIs
Click a KPI card to jump to the related tab or filtered view:
| KPI | Meaning | Click action |
|---|---|---|
| Compliance score | Overall posture percentage; status band at 90%+ (healthy), 70–89% (attention), below 70% (at risk). | Analytics → compliance score trend |
| Open violations | Total open policy violations in scope. | Violations tab |
| Active policies | Enabled policies contributing to evaluation. | Analytics → policy distribution |
| Critical / high | Priority violations requiring review. | Violations tab filtered to critical and high |
Tabs
| Tab | Purpose |
|---|---|
| Violations | Org-wide Open violations explorer — drill down by stack, policy, and resource; filter by severity from hero KPIs. Uses admin audience (includes Evaluate policies in empty state). |
| Exceptions | Time-bound policy waivers with approval workflow. Requires governance:approve to approve (Compliance Officer preset). |
| Remediation | Remediation center — track enforcing violations, assign owners, sync with external tickets when change management is connected. |
| Posture | Policy coverage by cloud and stack; Scheduled compliance panel for automatic policy re-evaluation interval. |
| Analytics | Evaluation trend, compliance score trend, policy distribution by category, framework coverage, cloud distribution, policy pack usage, findings severity trend. |
| Settings | Policy gate, live-scan defaults, audit webhook, evidence delivery schedules, integrations — grouped by purpose. |
Setup wizard
Open from the header ⋮ → Setup wizard or Settings when onboarding is incomplete. Four steps:
- Install pack — install the recommended SOC 2 demo policy pack (
soc2-pack) or continue with existing policies. - Gate mode — set org-wide Enforce, Advisory, or Fail-open for PLAN/APPLY.
- Evaluate — run an organization-wide policy evaluation (or skip).
- Done — mark onboarding complete; review violations or export from Reports.
Manual setup alternative: use Policy Packs and Policy Library, then return to finish gate mode and evaluation.
Policy gate modes
| Mode | Deploy behavior |
|---|---|
| Enforce | Blocks deployment when policies fail or the gate cannot evaluate. |
| Advisory | Records violations but does not block deployment. |
| Fail-open | Blocks on enforcing violations; evaluation engine errors allow deploy with warnings. |
Settings tab checklist
- Org-wide policy gate mode and optional per-environment overrides.
- Live scanning defaults for new repositories (enabled, scanners, fail-on severity, runner, notify on failure).
- Audit webhook URL for governance-category events (JSON POST).
- Unified schedules — evidence export, compliance assessments, and related jobs.
- Integrations panel for governance-related connectors.
- Related links: IaC runtime images (Administration → IaC Engines), Jira/evidence (Administration → Integrations → Change Management).
Evidence delivery: Scheduled evidence bundles are delivered via webhook (HTTP POST). Email and S3 delivery may log intent until credentials are configured in Administration.
Permissions
| Permission / role | Typical access |
|---|---|
governance:read | View the dashboard, analytics, and read-only tabs. |
governance:manage or org Admin/Owner | Change settings, gate mode, webhooks, and schedules. |
governance:approve | Approve policy exceptions on the Exceptions tab. |
security:manage, policy:manage | Act on findings and remediations where permitted. |