Implemented claims point to repository evidence or a regulation. Targets are labeled as targets. Each document says what does not exist yet and what is waiting on counsel or the institution.
The Security page is the one-screen summary. This is the full packet.
Current versus target safeguards: risk assessment, access, encryption, monitoring, response, open work.
The three staff roles, how tenancy is enforced today, and the provisioning and access evidence a production pilot still needs.
Which actions need staff sign-off, which bounded paths can be configured, and where the demo stops.
What counts as an incident, the notification clock to the institution, and who owns triage.
Once you are signed in, the Guardrails page renders the allowed-and-prohibited matrix live against your institution's settings.