Gap report

The gap report combines SSIE semantic tags, compliance pack observations, and shadow telemetry into actionable findings.

Gap cache API

curl -s "$PAP_API/v1/compliance/gap-cache?environment=sandbox&limit=50" \
  -H "Authorization: Bearer $TOKEN" | jq '.items[] | {tag: .inferred_semantic_tag, gap: .gap_detected, severity: .gap_severity, remediation: .gap_remediation_code}'

Each row includes:

inferred_semantic_tag — SSIE classification
gap_detected / gap_severity — regulatory mapping gap
gap_remediation_code — stable code for runbooks
user_override_tag — operator correction via PATCH override

Executive report

curl -X POST "$PAP_API/v1/compliance/reports/run?environment=sandbox" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"regulation_pack_ids":["osfi_b13_identity_access"],"window_hours":48}'

Download JSON from Compliance & Gaps → Executive report for OSFI, FINTRAC, and PIPEDA section mapping.

CANNOT_ASSESS callout

CANNOT_ASSESS is not a failure. When a pack control requires PIP data (for example identity_provider) and no PIP is connected, observation Rego emits status: CANNOT_ASSESS with detail explaining the missing attribute source. Shadow discovery continues — traffic is still forwarded and other controls on the same pack may still report PASS or FAIL.

Remediation: Connect the PIP type named in the pack manifest (pip_type), wait for Policy Bridge sync, and re-run shadow traffic. Alternatively, accept CANNOT_ASSESS in the gap report and document it as out-of-scope until IdP integration is scheduled.

Symptom → PIP → outcome

Symptom	Missing PIP (typical)	Connect this way	Expected outcome
Every control shows `CANNOT_ASSESS`	No IdP / HR attribute source	Connect data sources → add identity PIP → Policy Bridge sync	Controls with `pip_required: false` move to `PASS`/`FAIL`; PIP-gated controls start assessing
Only identity controls are `CANNOT_ASSESS`	`identity_provider`	Map subject roles / groups from Okta/Entra/SCIM	`IA-*` controls produce PASS/FAIL with role evidence
Only finance / AML controls are `CANNOT_ASSESS`	Transaction / CRM attributes	Connect payment or CRM PIP used by FINTRAC/OSFI packs	LCTR/STR observations leave CANNOT_ASSESS
Gaps stay empty after traffic	Fingerprints not arriving	Confirm Bouncer `BOUNCER_ENFORCEMENT_MODE=shadow` and `POST /v1/compliance/fingerprints` succeeds	Discover tab shows pack relevance scores

Example observation detail:

{
  "control_id": "CCCP-L2-IA-4",
  "status": "CANNOT_ASSESS",
  "detail": "identity_provider PIP data not available in shadow input"
}

Troubleshooting: If every control shows CANNOT_ASSESS, verify at least one pack control has pip_required: false and that shadow traffic includes basic headers (e.g. Authorization, x-request-id). See Connect data sources.

Next steps: Generate controls