Control CoreDocs

title: Gap report description: Read SSIE gap cache entries, pack observations, and executive integrity reports from shadow discovery. audience: Compliance officers timeEstimate: 15 minutes prerequisites:

  • Compliance packs selected
  • SSIE cycle completed at least once

Gap report

The gap report combines SSIE semantic tags, compliance pack observations, and shadow telemetry into actionable findings.

Gap cache API

curl -s "$PAP_API/v1/compliance/gap-cache?environment=sandbox&limit=50" \
  -H "Authorization: Bearer $TOKEN" | jq '.items[] | {tag: .inferred_semantic_tag, gap: .gap_detected, severity: .gap_severity, remediation: .gap_remediation_code}'

Each row includes:

  • inferred_semantic_tag — SSIE classification
  • gap_detected / gap_severity — regulatory mapping gap
  • gap_remediation_code — stable code for runbooks
  • user_override_tag — operator correction via PATCH override

Executive report

curl -X POST "$PAP_API/v1/compliance/reports/run?environment=sandbox" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"regulation_pack_ids":["osfi_b13_identity_access"],"window_hours":48}'

Download JSON from Compliance & Gaps → Executive report for OSFI, FINTRAC, and PIPEDA section mapping.

CANNOT_ASSESS callout

CANNOT_ASSESS is not a failure. When a pack control requires PIP data (for example identity_provider) and no PIP is connected, observation Rego emits status: CANNOT_ASSESS with detail explaining the missing attribute source. Shadow discovery continues — traffic is still forwarded and other controls on the same pack may still report PASS or FAIL.

Remediation: Connect the PIP type named in the pack manifest (pip_type), wait for OPAL sync, and re-run shadow traffic. Alternatively, accept CANNOT_ASSESS in the gap report and document it as out-of-scope until IdP integration is scheduled.

Example observation detail:

{
  "control_id": "CCCP-L2-IA-4",
  "status": "CANNOT_ASSESS",
  "detail": "identity_provider PIP data not available in shadow input"
}

Troubleshooting: If every control shows CANNOT_ASSESS, verify at least one pack control has pip_required: false and that shadow traffic includes basic headers (e.g. Authorization, x-request-id). See Connect data sources.

Next steps: Generate controls