Control CoreDocs

Auto-generate controls

After shadow discovery surfaces gaps, Control Core can auto-generate draft controls from compliance pack observations — turning SHADOW_WOULD_DENY patterns into enforceable Rego without starting from a blank editor.

Workflow overview

Click to enlarge

How to use

  1. Complete shadow pilot and open Compliance & Gaps → Gap report (~5 min review).
  2. Select gaps with status Actionable (PIP connected or pip_required: false).
  3. Click Generate controls from gaps (or use generate controls wizard).
  4. SCCA proposes control names, conditions, and template bindings — accept or edit each draft (~10 min).
  5. Save drafts to the controls repo branch; Policy Bridge sync distributes to sandbox Bouncers.
  6. Run Control impact simulator against recorded shadow inputs before enforce.

API-first path:

curl -s -X POST "$PAP_API_URL/compliance/gaps/generate-controls" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"gap_ids":["gap-001","gap-002"],"environment":"sandbox"}'

How to review / audit

  • Controls → Audit Logs — CONTROL_CREATED, OPAL_SYNC_COMPLETED after generation
  • Compare generated control IDs to gap report clause mapping in compliance report export
  • Peer review: author + compliance sign-off before production promote

Review checklist:

  • Every generated control maps to at least one gap row
  • Simulator shows expected DENY/ALLOW for shadow replay samples
  • No duplicate controls for same path prefix (merge in Visual Builder)

Troubleshooting

Troubleshooting: Generate button disabled?

  • Gaps marked CANNOT_ASSESS need PIP first — connect your first PIP
  • Confirm GitHub controls repo connected: Settings → Controls Repository

Troubleshooting: Generated Rego fails validation?

  • Run Rego lint in Control Plane editor or regal lint locally on exported file
  • SCCA may omit guards — add default allow := false if missing

Next steps: Upgrade to enforce · SCCA authoring · Control scenarios