title: Shadow compliance discovery description: Deploy in shadow mode, fingerprint traffic, select compliance packs, observe gaps, and graduate to enforcement. audience: Platform engineers and compliance officers timeEstimate: 60 minutes (full lifecycle) prerequisites:
- Control Plane installed (Kickstart or Helm)
- At least one Bouncer registered in sandbox
Shadow compliance discovery
Shadow compliance discovery is the end-to-end lifecycle for mapping regulatory gaps before inline enforcement. Control Core evaluates every request through OPA in shadow mode — traffic always reaches your upstream API — while the Control Plane builds fingerprints, scores compliance packs, and produces gap reports you can convert into controls.
Time estimate: ~15 min to deploy shadow + ~45 min for representative traffic and first gap report.
Lifecycle
Click to enlarge
| Phase | Guide | Outcome |
|---|---|---|
| Deploy | Quickstart | BOUNCER_ENFORCEMENT_MODE=shadow, health checks green |
| Fingerprint | Fingerprint & discover | Path/field tokens aggregated from shadow audit |
| Select | Compliance packs | FINTRAC, OSFI, CCCP, NIST AI, HIPAA, etc. scored for relevance |
| Observe | Gap report | SSIE tags + pack observations including CANNOT_ASSESS |
| Report | Compliance report | PDF/JSON auditor export with clause mapping |
| Generate | Generate controls | Candidate Rego controls from gap findings |
| Enforce | Upgrade to enforce | License + enforce mode after review |
Who should use this path
- Compliance officers need audit-grade evidence (OSFI B-13, FINTRAC, PIPEDA, CCCP) before blocking production APIs.
- Platform engineers deploy the standard universal Bouncer image — no fork, no demo-specific code.
- Control authors promote gap findings into sandbox controls after Policy Impact Simulator review.
PIPs optional for discovery
Shadow discovery works from traffic fingerprints alone. Policy Information Points enrich observations when connected; controls marked pip_required in a pack manifest may report CANNOT_ASSESS until the expected PIP type is linked. See Gap report — CANNOT_ASSESS.
Troubleshooting: If
/complianceis hidden, enable Integrity pilot mode, Sovereign compliance dashboard, and Shadow enforcement mode under Settings → Feature Flags. See Troubleshooting.
Related guides
- Shadow Bouncer deployment — Bouncer-level shadow configuration (legacy entry; see redirect note there)
- Observe & audit — decision streams and SIEM
- Connect data sources — optional PIP enrichment
Next step: Shadow discovery quickstart