Establishing Link...
SecureEncrypted
Demo Active
Live demo — Sovereign Validator v1.4.0
Realized-State Compliance & Sovereign Guardrails
Sovereign Validator
Sovereign Validator scans Terraform state (.tfstate) — the deployed reality, not the code — against ~102 OPA Rego rules in 24 policy namespaces covering DORA, GDPR and AMLD5, with regulator-ready xBRL-CSV and evidence exports. Live on AWS EKS; the public demo scans synthetic Terraform state.
v1.4.0 · AWS EKS · live at validator.adraca.io · demo runs on synthetic Terraform state
Interface & Capabilities
Landing — drop a .tfstate file or run the sample state
Scan overview — findings, risk heatmap, 24 namespaces evaluated
CRITICAL finding detail with GDPR Art. 32 / DORA Art. 9 references
Copy-ready HCL remediation snippet on a finding
Register of Information — DORA Art. 28(3) / ITS 2024/2956
Evidence & export — board PDF, scan JSON, evidence ZIP, xBRL-CSV
Realized-state auditing
Parses .tfstate instead of HCL to inspect the ground truth of deployed infrastructure, with policy namespaces for AWS, Azure and GCP resources.
Regulator-ready exports
xBRL-CSV register-of-information export per ITS 2024/2956, plus an evidence ZIP with a SHA-256 manifest for every scan.
Incident classification
Classifies findings against the seven RTS 2024/1772 criteria with Zone A/B reporting countdown clocks (≤4 h / ≤24 h).
Architecture
Evaluation Engine (OPA Core)
Implements Open Policy Agent (OPA) with Rego to evaluate declarative infrastructure compliance rules against JSON input contexts.
Input Processor (.tfstate)
Recursive parser traversing module hierarchies inside Terraform state files to inspect the realized architecture instead of code.
GDPR Redaction Layer
Strips and HMAC-SHA256-hashes PII field values in the state file before any policy evaluation runs.
Reporting Layer
CTPP register (DORA Art. 28), xBRL-CSV ROI export, evidence ZIP with SHA-256 manifest, suppressions with audit trail.
Stage 01
State Ingestion
Parses .tfstate and flattens recursive module hierarchies into evaluable resource records.
Stage 02
GDPR Minimisation
PII values stripped or HMAC-hashed so no personal data reaches the policy engine.
Stage 03
Rego Evaluation
~102 rules across 24 namespaces — DORA, GDPR and AMLD5 policy sets — via OPA.
Stage 04
Findings & Exports
Violations with HCL remediation snippets; CTPP register, xBRL-CSV and evidence ZIP generated.
Deployment Specifications
Core Layer
OPA Rego Policy Engine
Coverage
DORA · GDPR · AMLD5 · EBA GL/2019/04
Audit Type
Realized State (.tfstate)
Policy Namespaces
24 (AWS, Azure, GCP) · ~102 rules
adraca --log-stream
[--:--:--]VALIDATOR v1.4.0 — SCAN STARTED...
[--:--:--]PARSING TERRAFORM STATE [SCHEMA V4]...
[--:--:--]REDACTING PII [HMAC-SHA256]...
[--:--:--]EVALUATING ~102 REGO RULES [24 NAMESPACES]...
[--:--:--]21 VIOLATIONS FOUND [SYNTHETIC DEMO STATE]...
[--:--:--]BUILDING CTPP REGISTER [DORA ART.28]...
[--:--:--]EXPORTING xBRL-CSV [ITS 2024/2956]...
[--:--:--]EVIDENCE ZIP SEALED [MANIFEST.SHA256].