Track Compliance

The Compliance module maps your AI estate to the regulatory frameworks auditors care about, tracks each control's status with evidence, and rolls it up into a posture score.

1. Track a control#

curl -X POST "https://your-company.authspoke.com/api/v1/ai/compliance" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "framework": "EU_AI_ACT",
    "controlRef": "Art.14",
    "title": "Human oversight",
    "status": "COMPLIANT",
    "owner": "[email protected]",
    "evidence": "Every session is terminable and every action is audited."
  }'

framework — SOC2, ISO_42001, EU_AI_ACT, NIST_AI_RMF. status — COMPLIANT, NON_COMPLIANT, IN_PROGRESS, NOT_APPLICABLE. controlRef — the framework's own reference (e.g. CC6.1, Art.14, GOVERN-1.1).

Adding a control emits COMPLIANCE_CONTROL_ADDED. Marking one NON_COMPLIANT on update emits a WARNING.

2. Review a control#

Updating a control stamps lastReviewedAt automatically:

curl -X PUT "https://your-company.authspoke.com/api/v1/ai/compliance/$ID" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "framework":"SOC2", "controlRef":"CC6.1", "title":"Logical access controls", "status":"COMPLIANT", "evidence":"AI identities use MTLS; policies enforce least privilege." }'

3. Pull posture#

curl -s "https://your-company.authspoke.com/api/v1/ai/compliance/posture" -H "Authorization: Bearer $TOKEN" | jq

{
  "totalControls": 3,
  "compliant": 2,
  "compliancePercent": 67,
  "byStatus":    { "COMPLIANT": 2, "IN_PROGRESS": 1 },
  "byFramework": { "EU_AI_ACT": 1, "NIST_AI_RMF": 1, "SOC2": 1 }
}

Console#

Enterprise AI → Compliance shows the posture ring, per-status counts and a per-framework breakdown — the view you hand an auditor.

The audit trail (Query Audit Events) is the evidence backing these controls: it proves who did what, when, across the entire AI estate.