title: Custom compliance analysis builder description: Build Shadow Bouncer scenarios for any framework — SOC 2, OSFI, FINTRAC, or custom controls — with PIPs, metadata mapping, and optional Rego. audience: Platform engineers and GRC analysts timeEstimate: 90 minutes prerequisites:

• Control Plane with Integrity pilot / compliance dashboard enabled
• Sandbox Bouncer deployed with BOUNCER_ENFORCEMENT_MODE=shadow
• At least one PIP connection per target environment

Custom compliance analysis builder

Use this guide when a customer wants Shadow Bouncer mode to produce an executive-ready integrity report mapped to any framework — not only the Canadian packs shipped by default. Examples: SOC 2 TSC, ISO 27001 annexes, internal risk registers, or bespoke GRC control libraries.

Online demo note: The public online demo runs Bouncers in enforce mode so policy showcases work live. Shadow mode and this builder apply to customer pilots and Kickstart/Custom installs.

What you can customize

Step 1 — Deploy Shadow Bouncer (per environment)

Shadow mode is opt-in per Bouncer instance. Typical pilot pattern:

1. Deploy a dedicated sandbox Bouncer with shadow mode for discovery.
2. Keep production Bouncers in enforce until sign-off.

Helm (customer install):

helm upgrade --install controlcore ./controlcore \
  -f values.yaml \
  -f values-shadow.yaml \
  --set global.shadowPilot.enabled=true \
  --set bouncerSandbox.env[0].name=BOUNCER_ENFORCEMENT_MODE \
  --set bouncerSandbox.env[0].value=shadow

Verify:

kubectl exec deploy/cc-bouncer-sandbox -- printenv BOUNCER_ENFORCEMENT_MODE
# Expected: shadow

Each Bouncer registers with its environment (sandbox or production). Audit rows and gap cache entries are scoped to that environment.

See Shadow Bouncer deployment for architecture and traffic-mirror options.

Step 2 — Configure PIPs and data sources (per environment)

SSIE classifies schema-time metadata, not live payload bodies. For each environment you analyze:

1. Open Settings → PIP Connections (or Integrations) while the environment selector matches your target (e.g. Sandbox).
2. Register connections for:
   • OpenAPI / API schema — REST resource inventory
   • IAM / IdP — subject attributes (Okta, Entra ID, etc.)
   • ERP / CRM metadata — column catalogs where applicable
3. Run a sync and confirm Metadata cache entries appear for that connection.

Environment rule: PIP connections are never shared across environments. A sandbox IAM connector does not appear in production reports — register both if you need parity.

Trigger SSIE manually:

curl -X POST "$CONTROL_PLANE_API/v1/compliance/ssie/run?environment=sandbox" \
  -H "Authorization: Bearer $TOKEN"

Repeat with environment=production when the production PIP catalog is ready.

Step 3 — Metadata mapping and gap overrides

1. Open Compliance & Gaps in the Control Plane (Integrity pilot feature flag on).
2. Confirm the environment selector (top bar) matches the Bouncer you are analyzing.
3. Review Regulatory mapping — SSIE-inferred semantic tags vs regulation packs.
4. Override misclassified fields via PATCH /v1/compliance/gap-cache/{id}/override?environment=sandbox.

Semantic tags are published to the PIP data bundle as data.pip.semantic_tags so optional Rego controls can reference them without hardcoding field names.

Step 4 — Optional Rego controls

Shadow mode evaluates the same Rego as enforce mode. Controls are optional but improve signal quality:

• Start from templates under canadian-financial-regulation/shadow-pilot-* (FINTRAC, OSFI B-13, PCI PAN).
• Author custom controls that read:
  • data.pip.semantic_tags
  • data.access_control.allowed_roles (data bundle — no hardcoded role literals)
  • Environment-specific bundle paths (policies/{resource}/{environment}/enabled)

Activate controls in sandbox first. Shadow Bouncer emits SHADOW_WOULD_DENY instead of blocking.

Step 5 — Custom regulation packs (SOC 2, ISO, internal)

Reports are driven by YAML regulation packs on the Control Plane API host (regulation_packs/*.yaml). Shipped examples include OSFI B-13, FINTRAC, PIPEDA, PCI-DSS v4, and a SOC 2 template.

Minimal custom pack:

id: my_internal_controls
display_name: Acme Corp — Q3 Access Review
framework: INTERNAL
jurisdiction: CA
sections:
  - id: AC-01
    title: Privileged access inventory
    control_template_refs:
      - shadow-pilot-osfi-b13-access
    gap_signals:
      - type: shadow_would_deny_rate_above
        threshold: 0.03
  - id: DATA-02
    title: Sensitive field exposure
    gap_signals:
      - type: unmapped_semantic_tag
        tags: [PII_HIGH_SIN, PCI_CARD_NUMBER]

Pack fields:

List available packs:

curl "$CONTROL_PLANE_API/v1/compliance/regulation-packs" \
  -H "Authorization: Bearer $TOKEN"

Step 6 — Generate the executive report

API (per environment):

curl -X POST "$CONTROL_PLANE_API/v1/compliance/reports/run?environment=sandbox" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "report_title": "SOC 2 CC6 — Sandbox shadow pilot",
    "window_hours": 168,
    "regulation_pack_ids": [
      "soc2_trust_services_criteria",
      "osfi_b13_identity_access"
    ]
  }'

UI: Compliance & Gaps → Executive report tab → Generate (respects current environment selector).

Response includes:

• executive_summary — gap counts, shadow would-deny total, mapping coverage %
• regulation_sections[] — one block per pack id
• environment — slug proving sandbox/production isolation

Environment separation checklist

• Shadow Bouncer registered in one environment at a time per pilot phase
• PIP connections created inside each environment (not reused)
• SSIE run invoked with ?environment= matching the selector
• Gap cache queries filtered by environment
• Report generated with the same environment parameter
• Production Bouncer stays enforce until formal cutover

Upgrade path

When the customer approves enforcement:

1. Set BOUNCER_ENFORCEMENT_MODE=enforce on the target Bouncer.
2. Restart pods / recycle the sidecar.
3. Re-run the report — shadow telemetry stops; deny/mask events appear as standard audit outcomes.

Same image, same Control Plane, same environment boundaries.

Related guides

• Shadow Bouncer deployment
• Multiple Bouncers
• Resource enrichment