Compliance

Compliance in Strongly is tracked through solutions: named groups of workloads with governance policies applied. Every required field and gate across a solution's policies becomes a requirement, the solution's status is computed live from those requirements, and every governance action is recorded in an immutable audit log.

Solutions

Solutions group related workloads (workflows, apps, add-ons, data sources, volumes) into logical units for unified governance and compliance tracking. A solution typically represents a business capability or product composed of multiple Strongly resources.

Creating a Solution

1. Navigate to Governance > Solutions (or /governance/solutions)
2. Click Create Solution
3. Fill in the solution details:
   • Name (required), e.g., "Production ML Pipeline"
   • Description, what this solution covers
4. Pick Workloads from the tabbed picker (Workflows, Apps, Addons, Data Sources), with search
5. Pick Policies from the active policies list, with search
6. Click Create Solution

You can create an empty solution and add workloads and policies later from its detail page.

The Solution Detail Page

Open any solution to see and manage its full compliance state:

Section	Description
Compliance Progress	Progress bar of gates satisfied / failed / pending across all applied policies
Workloads	Every workload in the solution, with type badges; add via the workload picker (Workflows, Apps, Addons, Data Sources, Volumes) or remove
Applied Policies	Each policy with its category, severity, stage count, and gate count; add or remove policies
Gate Requirements	Every requirement grouped by policy, with inline forms to submit each one

The solution name and description can be edited inline, and the solution can be deleted from this page.

Completing Requirements

Each requirement in the Gate Requirements section renders the appropriate form for its kind:

• Input fields, enter the value (text, number, date, URL, email, and so on) and submit
• Acknowledgment, tick the checkbox to confirm the statement
• Approval, request approval; the configured reviewers are notified and the requirement stays pending until the quorum approves (see Stages & Reviews)
• Threshold, enter the metric value; it is immediately evaluated against the configured operator and target
• Evidence, upload files; the gate is satisfied once the minimum number of files is uploaded
• Guardrail, verify that the listed guardrails are configured on your AI Gateway model

Administrators additionally see a Waive action on each requirement, which requires a documented reason.

Solution Status

The solution status is recomputed automatically after every submission, approval, denial, and waiver:

Status	Meaning
Compliant	Every required field and gate is satisfied or waived (or the solution has no policies)
Non-Compliant	At least one requirement failed (a denial, missed threshold, or failed validation)
In Progress	Requirements remain pending

The Solutions list shows each solution's workload count, policy count, status, and last update, with search.

Access

You see solutions you own and solutions shared with you, scoped to your organization. Administrators see all solutions in their scope. Only the owner, shared users, or an administrator can submit gates or modify a solution.

Evidence

Evidence gates accept real file uploads:

• Allowed file types and a maximum file size can be configured per gate (see Policies)
• Uploaded files are stored by the platform and attached to the gate submission with name, type, size, uploader, and timestamp
• Each attachment gets a download URL under /api/v1/governance/evidence/ so reviewers and auditors can retrieve the exact file that was submitted
• Files can be removed and replaced while the gate is open

Audit Logging

Every governance action generates an immutable audit log entry. The audit trail provides change reconstruction for compliance reporting and regulatory reviews.

Logged Events

Entity Type	Actions
policy	created, updated, deleted, shared, unshared
solution	created, deleted
gate-submission	gate_submitted, gate_approved, gate_denied, gate_waived, admin overturns marked as gate_approved_admin_override / gate_denied_admin_override, and reviewers_orphaned_after_policy_edit when a policy edit removes reviewers who had already voted

Audit Log Entry Structure

Each entry contains:

Field	Description
entityType	Type of entity that was changed
entityId	ID of the entity
action	What action was performed
previousState	State before the change (for updates)
newState	State after the change
metadata	Contextual details such as the solution, policy, and gate involved
userId / userName	Who performed the action
timestamp	When the action occurred

Viewing Audit Logs

The audit trail viewer at /governance/audit is available to administrators. It shows the most recent entries (choose a limit of 50, 100, or 200) with:

• Search, free-text across user, entity ID, and action
• Entity filter, policy, solution, gate-submission, or notification
• Action filter, populated from the actions present in the loaded entries

Each row shows when, who, the action, the entity, and a details excerpt.

The audit trail is also available over the REST API at GET /api/v1/governance/audit (admin only, authenticated with your X-API-Key), with filters for entity type, action, user, and date range.

Regulatory Compliance

Mapping Policies to Frameworks

1. Identify applicable regulations for your organization
2. Create policies that enforce specific requirements from each framework
3. Tag policies with the relevant framework names (e.g., soc2, hipaa, gdpr, iso-27001, pci-dss) so they are easy to find and report on
4. Group the in-scope workloads into solutions and apply the policies
5. Use gate submissions, approvals, and evidence uploads as your compliance record

Evidence Trail for Auditors

For regulatory audits, the following governance artifacts serve as evidence:

Artifact	Evidence Value
Policy definitions	Document what controls are in place, with automatic version history
Gate submissions	Show that controls were applied and what was submitted, by whom, and when
Approval records	Prove that qualified reviewers approved compliance, with comments and timestamps
Evidence attachments	The actual documents submitted, retrievable by URL
Waive records	Document exceptions with the administrator and written reason
Audit logs	Complete action history with before/after state

Best Practices

Establish Governance Early

• Define policies before deploying resources to production
• Document the purpose and requirements for each policy
• Communicate governance processes to all team members
• Review and update policies periodically; significant changes are versioned automatically

Use Solutions Effectively

• Group resources by business capability or product
• Keep solution names and descriptions meaningful; they appear in reviewer inboxes and deploy-block messages
• Apply the smallest set of policies that covers the solution's obligations
• Remove workloads that leave the solution's scope so their deploys are no longer gated

Preserve the Audit Trail

• Prefer waiving a requirement (with a reason) over deleting policies to unblock a deploy
• Review the audit log during internal and external audits
• Watch for admin-override and reviewers-orphaned entries; they flag decisions that deserve a second look

Important

Deleting a policy deletes its gate submissions, and a policy used by any solution cannot be deleted until it is removed from those solutions. Audit log entries are retained independently, so past actions remain reconstructible.