Observability & Trust

Control Core separates compliance audit evidence from troubleshooting telemetry — keeping both privacy-aware, regulator-ready, and support-safe.

Canadian sovereignty & zero foreign egress

Control Core is designed for Canadian data residency and customer-boundary sovereignty:

• No observability telemetry leaves your customer VPC, or the online-demo perimeter, unless you explicitly configure an outbound destination you own (for example your corporate Splunk HEC).
• Libraries and container images for Control Core and optional add-ons are delivered online from your approved registries (Canadian-region delivery such as ca-central-1 for AWS Canada customers). Core PBAC does not depend on foreign SaaS phone-home.
• Grafana and Langfuse are optional components you pick at deploy time. They are never required for Rego-based enforcement or for compliance audit export.
• Default compliance path: Control Plane audit APIs + SIEM outbox (Splunk, Microsoft Sentinel, Elastic, QRadar, or custom). Reuse the SIEM you already run — you do not need bundled Grafana.

License phone-home is separate: subscription/license heartbeats (when enabled) are distinct from observability telemetry. See Telemetry management. Observability and audit stay inside your boundary by default.

Start Here

• Audit API Integration — Primary compliance path: REST polling, SIEM connectors, webhook push, audit schema v2, regulatory export
• Telemetry hub — index of audit, SIEM, and optional Grafana/Langfuse guides
• How Logging Works
• Audit vs Diagnostic Logs
• Grafana setup — optional dashboards (Loki/Prometheus)
• Langfuse setup — optional LLM tracing & evaluation (OTLP, sovereign self-hosted)
• Security of Support
• Remote Troubleshooting Runbook
• PBAC Operator Playbooks

Core Principles

1. Policy-governed logging — log redaction decisions are policy-driven (Rego), consistent with active controls — never mock or app-side PDPs.
2. Separation of concerns — immutable audit records answer who did what, when, and with what outcome; diagnostic traces answer how the system behaved.
3. Support-safe evidence sharing — exports use mandatory TICKET_REF context and package integrity metadata.
4. Actionable diagnostics — outputs include probable causes, evidence links, and remediation steps.
5. SIEM-ready by default — every event conforms to audit_event_v2 with full traceability fields for SIEM triage and regulatory evidence. Grafana/Langfuse remain optional add-ons.

Developer API

Consume audit events programmatically without UI access:

Developer Portal: Customers with Control Plane deployed can explore and try all audit endpoints interactively at /devdocs on their Control Plane URL.

For the full developer guide with curl examples, schema field reference, provider-specific setup (Splunk, Grafana, Elastic, Sentinel), and signature verification code, see Audit API Integration.

Audit event categories

Every audit record belongs to one of the following categories — used for filtering, SIEM triage, and regulatory export scope: