Make every boundary explicit.

Minimal discovery by design

Discovery uses temporary, narrowly scoped access to selected accounts, subscriptions, projects and regions. The portal shows the resources and relationships it understood, along with permissions or evidence that remain missing.

Production records, database or object contents, secrets, raw payloads and sensitive logs stay outside the managed assurance-metadata boundary.

Application source is quarantined, not trusted

Provider-authorised application material enters tenant-isolated encrypted quarantine. Digest, ownership, malware, secret, licence and policy checks decide whether it can become approved package material. Custody alone is never permission to execute it.

Unknown code must be boxed in before it starts

The admission standard for a hosted application proof is a short-lived, VM-isolated unit with no workload identity, no route to product networks and zero default egress. A customer-contained proof instead uses short-lived, scoped credentials and a declared target boundary.

External API access requires an exact brokered exception. Raw application logs, files and environment data are not exported as evidence.

Evidence over broad assurances

A result must record what executed, where it ran, which package and checks were used, what left the boundary, what failed and whether cleanup completed. A simulator result is never presented as original application execution.