Watch a decision get
gated, signed, and proven.

The NICE Framework maps every cybersecurity task to the right human competency. CWN uses this mapping to connect decisions to the people who should own them.

• Operate & Maintain (OM): ✓ This decision was processed entirely by the automated pipeline — no operator intervention needed. CWN reduces manual decision overhead by ~95%, freeing OM-role staff to focus on system health and capacity planning instead of rubber-stamping approvals.
• Oversee & Govern (OG): ✓ The signed TrustAtom receipt provides the cryptographic proof that governance teams need for audit cycles. Instead of collecting screenshots and spreadsheets, OG-role staff can point auditors directly to the immutable trust graph.
• Securer / Protect & Defend (SP): ✓ The zero-trust decision model means every request is verified and signed regardless of origin. SP-role architects can validate that the policy rules match organizational risk appetite — the system enforces, humans govern.
• Analyze (AN): ✓ Decision patterns are logged with full context (action, resource, agent, latency, policy trace). AN-role analysts can query the trust graph to surface anomalies, trend shifts, and policy gaps without reconstructing events from scattered logs.

Every TrustAtom decision actively mitigates known attack techniques. Here's what this specific decision defended against.

• T1078 — Valid Accounts: ✓ Mitigated. The principal was authenticated before reaching the policy gate. Even if credentials were compromised, the decision audit trail captures exactly who did what and when — creating a forensic chain that makes lateral movement detectable.
• T1134 — Access Token Manipulation: ✓ Mitigated. Token passthrough is explicitly denied by policy. The Ed25519 signature on this TrustAtom proves the decision was made by the policy engine — not injected by a modified token. Any attempt to forge a receipt will fail signature verification.
• T1020 — Automated Exfiltration: ✓ Mitigated. EXPORT_INTEGRATION actions are classified as restricted and require production environment context. This resource classification prevents automated tools from silently exporting data through the trust graph.
• T1562 — Impair Defenses: ✓ Mitigated. The audit trail is append-only. Decision records, TrustAtoms, and policy evaluations cannot be modified or deleted after creation. An attacker who gains access cannot cover their tracks by editing the trust graph.

Each TrustAtom is a piece of SOC 2 audit evidence. When your auditor asks "how do you enforce access control?", you show them this.

• CC6.1 — Logical & Physical Access Controls: ✓ Control active. Every request passes through a policy gate before accessing any resource. This decision proves the control was enforced — the TrustAtom signature is the evidence. No request bypasses evaluation.
• CC6.3 — Role-Based Access: ✓ Control active. The principal's role was evaluated against the OPA policy rules. Roles are not self-assigned — they're validated at decision time. The policy trace shows exactly which role rules were matched.
• A1.2 — Recovery & Availability: ✓ SLA maintained. Decision latency of ~47ms is well below the 500ms SLA threshold. Even when the primary policy engine (OPA) is offline, the sandbox fallback ensures zero downtime — decisions continue with a hardened rule set.
• C1.1 — Confidentiality Commitments: ✓ Encryption enforced. All API communication uses TLS 1.3. TrustAtom evidence hashes prevent data tampering in transit. Resource classification ensures sensitive data categories (EXPORT, SECRETS) get elevated scrutiny.
• PI1.1 — Processing Integrity: ✓ Integrity proven. The SHA-256 evidence hash and Ed25519 signature together prove this decision was made correctly and hasn't been altered. Any modification — even a single bit — will cause verification to fail.