/enterprise/orgs/{org_id}/compliance) is the admin and team-lead workspace for control-health evidence. Concepts and catalog details live in Compliance.
Sub-navigation
Developers do not see the Compliance tab.
Control health
Path:/enterprise/orgs/{org_id}/compliance
What you’ll see
- Control ID, title, TSC tags, latest status, population count, exception count
- A ? help tooltip explaining pass / warn / fail / na / pending and the buttons
- Optional retention banner when compliance retention was lowered (RC-AI-10 warn)
What you can do
Snapshots also run nightly at 02:00 in the organization timezone (from alert settings; default America/Toronto). Until the first snapshot exists, status shows as pending.
Population rows are IDs and categories only. They never include prompts, file contents, or secret values.
Access reviews
Path:/enterprise/orgs/{org_id}/compliance/access-reviews
1
Create a campaign
Admins set a label, due date, and scope (
gateway_keys, org_api_keys, members). The campaign opens as active with frozen item snapshots.2
Decide items
Reviewers open the campaign, choose keep / revoke / modify / rotate, and enter a required reason. Shared-key exposure items only allow keep or rotate.
3
Complete with attestation
When every item is decided, an admin completes the campaign with the attestation checkbox. The report stores
completed_by, timestamp, and report_sha256.Exceptions
Path:/enterprise/orgs/{org_id}/compliance/exceptions
- Create an exception with kind, rationale, and expiry
- Admins approve, revoke, or extend (extension still capped at 12 months from now)
- Kinds include
accepted_finding,dlp_exception,control_threshold_override, and related waiver types
accepted_finding exception and dismisses the finding.
Evidence & exports
Path:/enterprise/orgs/{org_id}/compliance/evidence
Admins generate a CSV (zipped) evidence pack for a date range and selected controls. Downloads are rate-limited. Exports are content-free control results suitable for auditor packages.
Compliance settings
Path:/enterprise/orgs/{org_id}/compliance/settings
Admins can set compliance retention days (default oriented around a Type II window plus fieldwork). Lowering below the recommended floor requires confirmation, writes an audit event, shows a banner on Control health, and makes RC-AI-10 warn. Legal hold still blocks destructive purge.