Configuration evidence
Collect registered control observations without arbitrary attribute maps.
Find identity-control gaps before attackers use them.
2AYE records typed posture observations, evaluates the versioned enterprise identity baseline, assigns findings to owners, enforces expiring exceptions, and refuses remediation unless a newer compliant observation proves the exact control changed.
- Configuration evidence
- Versioned benchmark
- Governed exceptions
What you can evaluate
Versioned posture assessment and evidence-backed remediation available through guarded APIs.
Versioned benchmark
Evaluate seven named identity controls against VERID_ENTERPRISE_BASELINE version 1.
Governed exceptions
Require optimistic concurrency, an accountable actor, and expiration within 90 days.
Verified closure
Close only from newer compliant evidence matching the exact tenant, control, and resource.
Follow Identity Security Posture Management from identity to evidence.
Each consequential action moves through the same six control points. See where 2AYE evaluates authority, requests human review, and preserves the outcome.
- 01IdentityWho or what is acting
- 02IntentSigned purpose and limits
- 03PolicyDeterministic evaluation
- 04ApprovalA named human when required
- 05ExecutionSingle-use grant, redeemed at the resource
- 06EvidenceReceipt joined to the audit chain
A practical adoption path
Start with one consequential workflow. Prove the boundary before expanding.
Assess
Document the environment, threat model, and integration boundary.
Design
Select protocols, signals, policies, and failure behavior.
Validate
Test vendor-specific APIs, tenant isolation, and abuse paths.
Release
Mark available only after deployed end-to-end verification.
What this includes
- Typed posture observations
- The versioned enterprise identity baseline across seven named controls
- Findings assigned to accountable owners
- Expiring exceptions with optimistic concurrency
- Closure only from newer compliant evidence