ARC-AI-009 assessment
Attested by operations@arctransformationgroup.com on 2026-10-26; valid until 2027-01-24. This is a human statement, not a test ARC performed.
Attested
Covering 2026-09-26 09:18:30Z to 2026-10-26 09:18:30Z — 7 action(s) and 8 evidence record(s) fell in that window. Every status below describes that period and nothing outside it.
- Control
- ARC-AI-009 (version 1)
- Assurance
- deployment
- Evaluated
- 2026-10-26 09:18:30Z
- Run
- arc_run_6fddf9…
- Integrity digest
- sha256:daaae8a6ea28f90127ecf2675f2bd29112d7c80476e9b80845a306df904d5d02
What this result does not establish
- This is the control most likely to be wrong in practice and the one ARC can say least about. A product that reported it green from its own records would be lying.
- An attestation is a statement by a person at a point in time. It goes stale, and ARC reverts the control to not assessable when it does rather than carrying the old answer forward.
The attestation this rests on
- Attested by
- operations@arctransformationgroup.com
- Statement
- Reviewed network routes and connector credential scopes for Stripe and GitHub: no credential reachable by an agent permits direct API access outside ARC Control.
- Valid until
- 2027-01-24 09:18:30Z
Observations
2 examined, 0 failing
| Result | Subject | Kind | What was observed | Evidence |
|---|---|---|---|---|
| ok | github | system | covered by attestation arc_att_b28495294bb5dbddc0bffc31c6331753: Reviewed network routes and connector credential scopes for Stripe and GitHub: no credential reachable by an agent permits direct API access outside ARC Control. | — |
| ok | stripe | system | covered by attestation arc_att_b28495294bb5dbddc0bffc31c6331753: Reviewed network routes and connector credential scopes for Stripe and GitHub: no credential reachable by an agent permits direct API access outside ARC Control. | — |
{
"id": "arc_asm_510cbd634c191246b2de2aaf059fd6fe",
"schemaVersion": 2,
"runId": "arc_run_6fddf961fa6f723fc7c7aff98056028d",
"controlId": "ARC-AI-009",
"controlVersion": 1,
"organizationId": "default",
"status": "attested",
"assurance": "deployment",
"summary": "Attested by operations@arctransformationgroup.com on 2026-10-26; valid until 2027-01-24. This is a human statement, not a test ARC performed.",
"observations": [
{
"subject": "github",
"subjectKind": "system",
"ok": true,
"detail": "covered by attestation arc_att_b28495294bb5dbddc0bffc31c6331753: Reviewed network routes and connector credential scopes for Stripe and GitHub: no credential reachable by an agent permits direct API access outside ARC Control."
},
{
"subject": "stripe",
"subjectKind": "system",
"ok": true,
"detail": "covered by attestation arc_att_b28495294bb5dbddc0bffc31c6331753: Reviewed network routes and connector credential scopes for Stripe and GitHub: no credential reachable by an agent permits direct API access outside ARC Control."
}
],
"window": {
"from": "2026-09-26T09:18:30.472Z",
"to": "2026-10-26T09:18:30.472Z",
"actionsConsidered": 7,
"evidenceConsidered": 8
},
"attestation": {
"id": "arc_att_b28495294bb5dbddc0bffc31c6331753",
"controlId": "ARC-AI-009",
"attestedBy": "operations@arctransformationgroup.com",
"attestedAt": "2026-10-26T09:18:30.464Z",
"statement": "Reviewed network routes and connector credential scopes for Stripe and GitHub: no credential reachable by an agent permits direct API access outside ARC Control.",
"expiresAt": "2027-01-24T09:18:30.464Z",
"reference": "SECOPS-1184"
},
"limitations": [
"This is the control most likely to be wrong in practice and the one ARC can say least about. A product that reported it green from its own records would be lying.",
"An attestation is a statement by a person at a point in time. It goes stale, and ARC reverts the control to not assessable when it does rather than carrying the old answer forward."
],
"findingIds": [],
"evaluatedAt": "2026-10-26T09:18:30.472Z",
"evaluationMs": 0.247042,
"integrityDigest": "sha256:daaae8a6ea28f90127ecf2675f2bd29112d7c80476e9b80845a306df904d5d02"
}