Control CoreDocs

title: Generate controls from gaps description: Promote shadow gap findings into sandbox controls using templates and the Policy Impact Simulator. audience: Control authors timeEstimate: 20 minutes prerequisites:

  • Gap report reviewed
  • Policy admin role in sandbox

Generate controls from gaps

Convert gap findings into enforceable controls (Rego policies) after shadow discovery — never before executive review.

  1. Prioritize gaps — sort gap cache by gap_severity (CRITICAL, HIGH, …).
  2. Map to templates — open Control templates and filter by category matching the pack (e.g. Canadian financial regulation).
  3. Copy control — use Copy Control to open the Visual Builder with template Rego pre-loaded.
  4. Simulate — run Policy Impact Simulator on paths that produced SHADOW_WOULD_DENY.
  5. Enable in sandbox — activate the control while Bouncer remains in shadow to validate observations without blocking traffic.
  6. Document CANNOT_ASSESS — defer controls that still require PIP data; track in change record.
# Optional: list shadow evidence for a would-deny path
curl -s "$PAP_API/v1/compliance/shadow-telemetry?environment=sandbox&limit=20" \
  -H "Authorization: Bearer $TOKEN" | jq '.items[].decision_id'

Troubleshooting: If Simulator results differ from shadow audit, confirm the same control bundle is active on the sandbox Bouncer and OPAL sync completed (GET /health/opal-bridge). See Troubleshooting controls.

Authoring rules

  • Author controls only through the Control Plane — GitHub policies repo is downstream.
  • Do not embed remediation prose or role names in Rego; use bundle-supplied data and semantic tags.
  • Keep the protected application policy-blind.

Next steps: Upgrade to enforce