Shadow compliance discovery
Audience: Compliance officers and platform engineers
Time: ~60 minutes (full lifecycle); ~15 minutes to begin discovery
Before you block production traffic, regulators and internal audit teams need evidence: which APIs expose sensitive data, which frameworks apply, and where current access patterns fall short. Shadow compliance discovery gives you that evidence first — by observing real traffic, scoring regulatory packs, and producing gap and compliance reports you can review with stakeholders. Only after sign-off do you graduate to inline enforcement.
Control Core evaluates every request against your controls in shadow mode: traffic always reaches your upstream application while the Control Plane records what would have been allowed, denied, or masked. That posture lets compliance officers build an audit trail and platform engineers validate wiring — without risking a production outage on day one.
Recommended first posture for new deployments
For new Control Core rollouts, shadow mode is the recommended starting posture. It narrows risk while you:
- Collect representative traffic fingerprints across sandbox (and optionally production mirror paths)
- Select and score compliance packs relevant to your industry and jurisdiction
- Review gap findings with legal, risk, and engineering before any deny or mask takes effect
When discovery, gap review, and control simulation are complete, upgrade the Bouncer to enforce mode. See Upgrade to enforce.
Troubleshooting: If the Compliance area is not visible in the Control Plane, confirm shadow discovery is enabled in your deployment profile and that the sandbox Bouncer is registered with a healthy heartbeat. See Troubleshooting.
How it works
Shadow discovery connects live traffic to a structured compliance workflow. The Control Plane aggregates fingerprints from shadow decisions, matches them against pack manifests (OSFI, FINTRAC, PIPEDA, CCCP, HIPAA, NIST AI RMF, and others), and surfaces gaps you can export or convert into controls.
Click to enlarge
One Control Plane orchestrates the lifecycle. Bouncers in shadow mode observe without blocking. Every evaluated request contributes to fingerprints and gap evidence — ready for compliance review before enforcement.
Fingerprint traffic
Business challenge: Compliance teams rarely have a complete, current map of which API paths, methods, and response fields carry regulated data. Spreadsheets and architecture diagrams go stale; auditors ask for proof tied to actual production patterns.
How Control Core helps: Shadow decisions aggregate path and field tokens from live traffic into resource fingerprints. The Control Plane rolls these up so you see what is really being accessed — not what documentation assumed.
Outcome:
- A data-driven inventory of API surface area grounded in observed traffic
- Evidence that discovery reflects real usage, not one-off test calls
- A baseline for scoring compliance packs and gap analysis
Guide: Fingerprint & discover
Select compliance packs
Business challenge: Organizations face overlapping frameworks — OSFI B-13, FINTRAC, PIPEDA, PHIPA, CCCP, HIPAA, SOC 2, NIST AI RMF, and sector-specific rules. Choosing where to focus without boiling the ocean is hard when every framework has hundreds of clauses.
How Control Core helps: Compliance packs bundle framework clauses with observation rules. The Control Plane scores pack relevance against your traffic fingerprints so you prioritize packs that match your resources and data classes.
Outcome:
- Focused scope — work on frameworks that matter for your deployment
- Shared vocabulary between compliance officers and platform engineers
- Traceable mapping from observed traffic to regulatory themes
Guide: Compliance packs
Observe gaps
Business challenge: Knowing a framework applies is not the same as knowing you meet it. Manual control assessments lag behind API change velocity and often miss edge paths that only appear under real load.
How Control Core helps: Gap analysis compares pack observations against shadow evaluation results. Findings include structured tags and statuses — including CANNOT_ASSESS when a pack clause needs a connected data source (PIP) that is not yet linked.
Outcome:
- Prioritized gap list tied to observed traffic, not theoretical checklists
- Clear disposition for items that need PIP enrichment versus code or control changes
- Input for risk committees before enforcement go-live
Guide: Gap report
Compliance report
Business challenge: Auditors and regulators expect exportable evidence: which clauses were evaluated, what was observed, and what remains open. Screenshotting dashboards does not scale across examination periods.
How Control Core helps: Generate PDF and JSON compliance reports with clause-level mapping from pack manifests to observations. CANNOT_ASSESS rows are included as evidence — they document where additional context is required, not silent passes.
Outcome:
- Auditor-ready exports without manual report assembly
- Repeatable evidence packs for OSFI, FINTRAC, PIPEDA, CCCP, and other selected frameworks
- A signed-off artifact to attach to enforcement readiness reviews
Guide: Compliance report
Generate controls
Business challenge: Gap findings must become enforceable controls — consistently authored, reviewed in sandbox, and traceable back to the observation that triggered them. Ad-hoc control code or one-off app changes recreate the compliance debt shadow discovery was meant to eliminate.
How Control Core helps: The Control Plane proposes candidate controls from gap findings. Control authors refine them in the Controls Manager, run Policy Impact Simulator scenarios, and promote approved controls to sandbox before production.
Outcome:
- Faster path from gap to draft control — with human review retained
- Controls linked to regulatory observations, not orphaned rules
- Sandbox validation before any inline deny or mask affects users
Guide: Generate controls
Upgrade to enforce
Business challenge: Flipping to blocking enforcement without stakeholder sign-off creates operational and regulatory risk — blocked legitimate traffic, incomplete coverage, or controls that do not match observed behavior.
How Control Core helps: After gap triage, simulator review, and compliance report sign-off, upgrade the sandbox Bouncer from shadow to enforce mode under your licensing entitlements. Production promotion follows the same control lifecycle you use for any other deployment.
Outcome:
- Enforcement aligned with evidence already reviewed by compliance and engineering
- Audit trail showing shadow period, gap disposition, and enforce cutover
- Confidence that the first production deny matches patterns already observed in shadow
Guide: Upgrade to enforce
Getting started
Platform engineers wire the sandbox Bouncer in shadow mode and confirm health checks. Compliance officers can begin reviewing fingerprints as soon as representative traffic flows.
| Step | Guide | Outcome |
|---|---|---|
| Begin discovery | Quickstart | Shadow posture active, Compliance dashboard receiving telemetry |
| Fingerprint | Fingerprint & discover | Traffic tokens aggregated |
| Select packs | Compliance packs | Frameworks scored for relevance |
| Observe gaps | Gap report | Prioritized findings |
| Export evidence | Compliance report | PDF/JSON auditor package |
| Draft controls | Generate controls | Candidate controls for review |
| Enforce | Upgrade to enforce | Inline enforcement after sign-off |
Infrastructure detail (Helm values, environment variables, placement): Shadow Bouncer deployment
Who should use this path
- Compliance officers need audit-grade evidence (OSFI B-13, FINTRAC, PIPEDA, CCCP, and related frameworks) before approving production blocking.
- Platform engineers deploy the standard universal Bouncer — one image, no resource-specific forks — and graduate to enforce only after gap review.
- Control authors promote gap findings into sandbox controls after Policy Impact Simulator review.
Data sources optional for discovery
Shadow discovery works from traffic fingerprints alone. Connected data sources (PIPs) — identity providers, consent stores, HR systems — enrich observations when available. Pack clauses marked as requiring a PIP may report CANNOT_ASSESS until the expected connection is linked. That status is valid evidence: it records where live context is needed, not an automatic pass.
See Gap report — CANNOT_ASSESS and Connect data sources.
Related guides
- Shadow Bouncer deployment — infrastructure and shadow configuration reference
- Regulatory compliance use case — how controls encode framework requirements at enforcement time
- Observe & audit — decision streams and SIEM forwarding
- Connect data sources — optional PIP enrichment for fuller assessments
Next steps
- Shadow discovery quickstart — begin in shadow mode (~15 min)
- Gap report — review prioritized findings
- Compliance report — export auditor evidence
- Upgrade to enforce — after sign-off