01
Evidence
Record trusted facts from across the SDLC, in a form that can be queried and connected.
An append-only record stores every fact. No actor can fake, modify or delete history.
Big News: Kosli’s achieves Series A milestone with Deutsche Bank as an investor - Read the announcement
New: Kosli Answers is here! AI-powered insights for compliance and security. Learn more →
GOVERNANCE INFRASTRUCTURE
What is Governance Infrastructure?
Learn how the infrastructure principles behind Governance Engineering help you record events as verifiable facts, automate controls, and prove compliance continuously.
The Infrastructure Stack
Architecture for Governance.
An architecture for Governance Engineering built on proven technology principles: layered responsibilities, an immutable record, and computed projections. It scales to large, complex environments.
02
Control
Express and apply policy as controls, mapped to the evidence that satisfies them, operated automatically.
Controls read evidence from the record. Every decision is written back to the record as a fact.
03
Audit
Demonstrate assurance to auditors, regulators, customers, and the board, continuously and as of any point in time.
A digital record of audit data makes audits a query rather than a project. Evidence is available on demand.
04
Insight
Provide insight into how the SDLC and its controls are actually performing.
Use data from across the SDLC to provide status, trends, and metrics, computed from the live record.
The sections below describe each layer in turn. Read on to learn the responsibilities of each layer, and what it looks like in Kosli.
LAYER 01 · EVIDENCE
Record every event as a verifiable fact.
The foundation of governance is a trustworthy system of record. That's why the base of the stack is an append-only, immutable ledger of facts.
Attestations and snapshots
ATTESTATIONS: claims that an action happened (tests passed, a change was approved) and SNAPSHOTS: observations of the state of an environment.
Content Addressable Identities
Every artifact is identified by its cryptographic identity such as git commit or SHA256 checksum, not its name or tag. Evidence is connected via identities or correlation ids so that you can build a chain of custody from commit to production.
Append-only, independent record
The system of record has no update and no delete. A correction is a new fact, and the old one remains. Kosli holds the record outside your infrastructure, so altering history isn’t possible.
Flexible evidence types with schemas
Define the fact types your governance needs. Evidence that does not meet its schema is rejected at write time, and evaluated on ingest. Raw material (test output, SBOMs, scan reports) can be attached and fingerprinted in the Evidence Vault.
LAYER 02 · CONTROL
Controls run as code.
The Control layer automates policy as code. Decisions are based on recorded evidence and context inputs.
Controls as versioned entities
Every control has a unique, immutable identity and a version history. Names and descriptions can change; the history does not. Every decision records the control and policy version that made it.
Policy as code
Compliance requirements are versioned, testable policies, evaluated automatically. The results are idempotent: the same input evidence produces the same decision, every time.
Decisions recorded as facts
Compliant or non-compliant, with the reason, the policy version, and the evidence it read. The Control layer’s own actions are written back to the Evidence layer.
Distributed Enforcement Points
Decisions get enforced in CI pipelines, deployment tools, and admission controllers.
Exceptions, overrides, and break-glass
Emergency fixes and approved deviations are part of the system. Each is recorded: who, what, when, and the reason.
LAYER 03 · AUDIT
Audit compliance from a continuous record.
Assurance is monitored from the record. Reconciliation is continuous, and anyone can verify it against the facts at any time.
Flexible Reporting Engine
Support for queries across controls, organizational entities and systems. Complete evidence bundles for any change: attestations, evidence files, spreadsheets and pdf reports.
Runtime Views
Point-in-time views of how runtime environments evolve, reconciled against change sources, policy evaluations, and control coverage.
Continuous Audit
Compliance evaluation with policies to find non-compliance in real time instead of at audit. Every change is evaluated against policy and evidence requirements.
LAYER 04 · INSIGHT
Data insights into technology governance.
Organizational insight based on facts: the evidence record contains rich information on every deployment, decision, and change. Use it to gain insight into status, trends, and metrics.
Delivery metrics from facts
Deployments are calculated from the evidence, not reported by people. The metrics agree with the audit reports because they come from the same facts.
Control coverage
Track which controls are enforced, compliance and non-compliance rates, and exception processes across the estate.
Getting started
Start with Evidence. Each layer builds on the last.
Adoption follows the dependency order. Controls need evidence, audit needs decisions, and insight needs all three. Each step delivers value on its own.
-
01
Record
Connect pipelines and environments through integrations, the CLI, or the API. Teams keep their existing tools.
-
02
Control
Turn existing checks into policies. Report non-compliance first; block when the control is stable.
-
03
Prove
Produce reports, audit packages, point-in-time reconstruction, and continuous compliance status from the record.
-
04
Improve
Measure delivery and controls from the same facts, and improve controls with the same methods as software.
Build vs buy
The advantage of an independent evidence store.
The independence requirement decides the build-versus-buy question for the bottom layers.
Security Guarantees
A governance record on your own infrastructure can be altered. Keeping your own governance record is the same as auditing yourself. Passing an audit requires proving the security claims of your system.
Build and maintenance costs
Governance Infrastructure is a complex product, needing extensive development, ongoing maintenance, and guaranteed availability.
Proven technology exists today
Kosli provides Governance Infrastructure, and is running in production at major financial organizations. Kosli maintains the integrations as toolchains evolve, and operates the platform as an enterprise service: with SLA's on availability and strong security guarantees.
Engineer the controls, not the infrastructure
The infrastructure is common across organizations. The controls are not: they encode your obligations, your risk appetite, and your audit history.
Where to apply it
Four entry points. The same four layers.
Each use case is a vertical slice through Evidence, Control, Audit, and Insight, applied to one area of the SDLC.
Build
Software Supply Chain Security
Every artifact accounted for, with a verified chain of custody back to source.
Release
Change Management Automation
Gates that read evidence, not tickets, and a change record that writes itself.
Run
Workload Compliance Assurance
Know what's running, and prove it was approved.
Cloud
Infrastructure Change and Drift Detection
Every change identified by how it was made: through the pipeline or around it.
SOC 2
Type II audited
Tier 1
financial institutions in production
FINOS
SDLC working group co-lead
2019
building since
Get started
See the four layers
See the four layers
on your own pipeline.
We'll show you evidence, controls, and proof on your delivery process, or on ours.
Watch it work, end to end
See the platform enterprise teams use to automate governance across build, release, and runtime.
Kosli in action