Ref 008 · thing · · open
Controls as code
An idea on the books — generate the compliance control register from CI, so every green check is a control and every run is evidence.
The idea, stated once: the control register auditors ask for should be generated, not maintained. Every automated check that already runs — CI gates, scheduled evidence jobs, monitoring probes — gets a small block of metadata naming the control it implements. A build step collects the blocks and emits the register: control, implementation, last run, last result, where the evidence landed. The auditor gets a table with timestamps instead of a shared drive with good intentions.
What makes this worth doing is the failure mode. When a check is deleted, its control goes visibly unimplemented in the next generated register — today, the document quietly keeps saying what it said last year.
Status is open, honestly: nothing is built. The unglamorous obstacles are
mapping messy real-world checks onto control frameworks without lying, and
the fact that half the controls that matter aren’t automatable at all. If it
moves, the register will say so.