From regulation,
to execution,
to evidence.

NIST AI RMF · NIST CSF 2.0

Governance, mapping, measurement and management functions expressed as executable controls rather than a maturity narrative.

SOX · ICFR

Control design and operating effectiveness for financial reporting, with change authority and segregation of duties evidenced at the moment of change.

SEC cybersecurity disclosure

Item 1.05 materiality determination and Item 106 governance disclosure, supported by a record of what was known, when, and on which system.

HIPAA · HITECH

Security Rule safeguards and breach notification timelines, with the administrative, physical and technical control set held as one sequence.

FedRAMP · NIST SP 800-53

Baseline control inheritance, continuous monitoring, and POA&M evidence produced as system output rather than assembled for assessment.

PCI DSS 4.0 · NY DFS Part 500

Customised approach documentation and annual certification obligations, held against the systems that actually implement them.

EU AI Act

Annex IV technical documentation, risk management system, post-market monitoring and transparency obligations for high-risk systems.

ISO/IEC 27001 · 42001 · SOC 2

Statement of applicability, AI management system requirements, and Trust Services Criteria mapped once across overlapping scope.

UAE · PDPL, CBUAE, NESA, SDAIA

Data protection, central bank model-risk supervision, critical infrastructure standards and national AI governance principles, for deployments in the Gulf.

Enterprise GRC

Holds the policy, the risk register and the board pack, at scale and well. It does not execute. Status is asserted by a person and inherited by the dashboard unchanged — the platform has no way to know whether the control ran.

Compliance automation

Collects evidence continuously across cloud and SaaS estates. It treats a collected status as authoritative: if the source reports green, green is recorded. Nothing establishes that the source was capable of reporting anything else.

ITSM and workflow

Routes the work, holds the approval, keeps the ticket trail. It has no view of which obligation takes precedence when four sources conflict, and no way to compute a correct order.

Policy-as-code

Enforces declarative policy at admission and request time, quickly and reliably. It enforces the policy it was handed. Deciding which of four conflicting authorities wins is upstream of it, and stays manual.

These are complements, not replacements; WeaveSynth is deployed alongside them. The difference is what happens at the edges — when authority conflicts, when a source cannot be reached, when a check does not complete. Every category above resolves that by inheriting a favourable default. This one reports the gap and stops.

Diligence needs the boundary, not the headline. Each capability on this page, with the exact limit of what it covers — so the question does not have to be asked on the call.

Framework mapping

Obligations are mapped from the frameworks named, with overlapping requirements resolved once. Naming a framework identifies an obligation. It is not a certification, an authorization, or an attestation of status.

Determinism

Identical inputs, under an identical version and configuration, produce an identical blueprint and an identical trace. A version or configuration change is an input change and is recorded as one; stability across upgrades is not asserted.

The single conduit

Instructions reach downstream systems through one gated path. The gate's refusal behaviour is exercised each release and the result retained, and no override is exposed. The claim is the tested behaviour and the absence of an override — not a proof that no bypass could exist.

Independent observation

The observational layer has no write path into execution. Its coverage is bounded by what is instrumented; anything outside that boundary is reported as unobserved, never as clean.

Evidence

Evidence records what was examined, on which build reference, in what state, and what was found. It is a record of examination. It is not an attestation that an obligation has been met — that judgement remains yours and your auditor's.

Unestablished results

A check that cannot be grounded is reported as unestablished and holds the gate. Exhaustive detection of gaps is not asserted; what is asserted is that a detected gap is never rendered as a pass.