Compliance As A Living Graph: Mapping Standards To What SG/Sentinel Actually Deploys
Summary
Compliance as a computed property of the running system, not a checkbox: build graph-based versions of the major standards (GDPR, ISO 27001, OWASP Top 10, OWASP AI), map each requirement to the platform capabilities and Sentinel rules that satisfy it, and the posture becomes a live readout — enable a logging rule and specific requirements flip to met; disable it and they flip back. The platform contributes inherent properties (encryption, zero-knowledge, audit trails) for free; Sentinel contributes the dynamic, rule-dependent ones. Specific and computed also means validatable by third parties — the opposite of a vague claim.
Key concepts
- The living compliance graph — deferred with the unified graph; the rule metadata schema keeps its slot
- The three graphs are one — rule prevents technique, satisfies requirement, observed as evidence
- Rules carry standard mappings — the metadata schema this vision needs, present from day one
Key ideas
- "No WAF in front of the product" genuinely breaks named requirements; encrypted-by-construction genuinely satisfies others — posture reflects reality in both directions.
- Conservative claims by design: show partial and unmet, never overclaim — the mapping supports certification, it is not certification.
- LLM-generated graph standards, multi-party-checked, community-verified, possibly standards-as-vaults in their own repo.
On this site
On the roadmap's deferred list; its business-value framing informs how the site presents the compliance direction without overclaiming.