← Assurance

Objective

The systems ARC governs are reachable by agents only through ARC, so a policy decision cannot be sidestepped.

Assurance

deployment

Frequency

quarterly

Severity if it fails

critical

Enabled

Yes

Category

authorization

ARC cannot test this from inside itself: whether an agent can call Stripe directly depends on network routes, firewall rules and who holds which credential — facts outside ARC’s records. This control therefore requires a dated attestation from a named reviewer confirming that, for each governed system, no credential reachable by an agent permits direct access. Without a current attestation the control reports not assessable, never a pass.

• This is the control most likely to be wrong in practice and the one ARC can say least about. A product that reported it green from its own records would be lying.
• An attestation is a statement by a person at a point in time. It goes stale, and ARC reverts the control to not assessable when it does rather than carrying the old answer forward.

Status

Attested

Summary

Attested by operations@arctransformationgroup.com on 2026-10-26; valid until 2027-01-24. This is a human statement, not a test ARC performed.

Evaluated

2026-10-26 09:18:30Z

Assessment

arc_asm_510cbd…

Covering 2026-09-26 09:18:30Z to 2026-10-26 09:18:30Z — 7 action(s) and 8 evidence record(s) fell in that window. Every status below describes that period and nothing outside it.

A human statement, not a test ARC performed. Each one expires; when the newest expires the control reverts to not assessable rather than carrying the old answer forward.