| Control | Implementation and boundary |
|---|---|
| 01Local and offline Desktop | The Windows Desktop workflow can operate locally without a product telemetry path. |
| 02Explicit human decisions | Human governance records remain attributable and cannot be created through remote transports. |
| 03Content-addressed revisions | Revisions make preserved state identifiable and support history and replay. |
| 04Current versus historical | The current readiness state remains distinct from the historical record that produced earlier outcomes. |
| 05Bundle integrity | The verifier detects changes to machine-readable Readiness Bundle material. |
| 06Local key custody | Windows DPAPI CurrentUser protects local key material within the signed-in Windows user boundary. |
| 07Local REST | Loopback REST uses a local bearer-token boundary. |
| 08Remote resource | HTTPS, externally issued OAuth tokens, bounded scopes and RFC 9728 metadata protect the remote resource profile. |
CIVITAS READINESS / SECURITY
Security boundaries you can inspect.
Civitas Readiness combines local operation, explicit human authority, preserved history and bounded transport security without turning integrity into a claim of truth.
IMPLEMENTED CONTROLS
State, authority and transport have separate boundaries
EXPLICIT LIMITATIONS
What the current posture does not claim
| Limitation | Public posture |
|---|---|
| 01Integrity is not truth | A valid integrity result does not prove that evidence is true, complete or legally sufficient. |
| 02No external certification | Civitas Analytica does not claim an external product or security certification. |
| 03No public multi-tenant SaaS | The remote protected-resource profile is not presented as a hosted public multi-tenant service. |
| 04No remote human governance | Remote clients cannot create human DecisionRecords. |
| 05No token-binding claim | The current profile does not claim DPoP- or mTLS-bound access tokens or WIMSE conformance. |
| 06Unsigned founder distribution | The current controlled Windows build is not Authenticode-signed and may trigger Unknown Publisher or SmartScreen warnings. |
PRINCIPLE
Verifiable does not automatically mean correct
Have a security boundary to evaluate?
Send only a non-sensitive summary of the deployment requirements.