Continuous control monitoring

Show where the control boundary is live.

Control Coverage turns raw connector and executor signals into an explicit view of what Fidacy can prove now, what it proved in the past and where the evidence stops.

Coverage states

How strongly identity is proven

A state says whether there is current evidence. It does not say evidence of what. Every control therefore carries an identity block stating how strongly its machine and agent are proven, on the same ladder policies use for min_identity.

An observer is authenticated with an organization credential. That proves the signal came from the organization, not which device or agent sent it: any holder of an organization key can report any machine name and any agent name. So observer names are declared, and a heading such as build-01 · CONNECTED means a connector calling itself build-01 is connected.

The binding field says what ties the name to the claim. A hard gate reports signed_mandate: the authority was issued by the organization to that name and enforced by the executor. That proves which name the authority belonged to, not which process redeemed the grant, so the actor stays at none.

Send an authenticated connector signal

The signal is tenant-authenticated, separate from anonymous product telemetry, and deliberately accepts only a closed host vocabulary. It contains boundary metadata, never a free-form action payload.

curl -s https://api.fidacy.com/v1/control-coverage/signals   -H "Authorization: Bearer $FIDACY_ENGINE_API_KEY"   -H "Content-Type: application/json"   -d '{
    "v": "fidacy.control-coverage.v1",
    "machine": "support-ops-eu-01",
    "host": "host_codex",
    "subject": "support-refund-agent",
    "clientVersion": "1.0.0"
  }'

Read coverage and reconciliation

The response includes controls and reconciliation totals: decisions, signed receipts, receipt artifacts, redeemed grants, unreedeemed grants and detected coverage gaps. It also reports outside_boundary_actions: NOT_OBSERVABLE rather than pretending to see actions that bypass every connected control.

{
  "controls": [{
    "state": "GATED",
    "enforcement": "HARD_GATE_PROVEN",
    "scope": "Signed grant gate · stripe.refund.create",
    "connection": "UNKNOWN"
  }],
  "reconciliation": {
    "decision_count": 12,
    "signed_receipt_count": 12,
    "decisions_without_receipt_artifact": 0,
    "grants_redeemed": 4,
    "coverage_gap_count": 0,
    "outside_boundary_actions": { "status": "NOT_OBSERVABLE" }
  }
}

Export a Control Coverage Report

A report is a signed period control object for an auditor, insurer or customer. It includes the monitored scope, control states, reconciliation, retention disclosure and a JWS that can be checked against Fidacy's public JWKS. It requires audit:read.

• ·Use an Incident Pack for one decision and its evidence.
• ·Use a Control Coverage Report for the operational condition of boundaries over the retained reporting period.
• ·Interruptions are computed over every retained signal, from the first one retained for each connector, so the report is complete for that history however long it is.

For third parties

Give an insurer or auditor the signed report and the public JWKS URL, not an unrestricted tenant key. A recipient can verify that the report was signed by Fidacy and see the report's stated scope and disclosures. They should not infer broader coverage than the report claims.

Read each control's identity before its liveness. A connected observer whose names are declaredis evidence that the organization's boundary was reporting, not that a specific device or agent was running. The same strength travels into the agent underwriting report.