Settings
What this deployment is configured to do, read from the control API rather than assumed.
Identity and access
Operator identity is not authenticated in this deployment. You are acting as operations@arctransformationgroup.com because a request header says so, behind a single shared token. Anyone holding that token can claim any identity, so an approval recorded here establishes that the workflow ran — not who ran it. Set ARC_OIDC_ISSUER to sign operators in against your identity provider; every approval cast after that is attributable to a person.
- Acting as
- operations@arctransformationgroup.com claimed, not authenticated
- Roles
- finance-manager, platform-oncall
- How operators sign in
- a shared token, with the name taken from a request header
- API
- http://127.0.0.1:8787
- Version
- 2.1.0
Enforcement
- Status
- ok
- Failure mode
- closed
- Effect when no policy matches
- DENY
- Rate limiting
- off
- Disabled tools
- none
Enforcement does not depend on the assurance layer. An assurance outage can stop ARC reporting on itself; it cannot stop ARC deciding, and it cannot open the gateway.
Assurance
- Status
- ok
- Controls installed
- 9
- Controls enabled
- 9
- Resting on a human statement, or unprovable
- 2 of 9 — read their summaries rather than counting statuses
- Last run
- arc_run_6fddf9… 2026-10-26 09:18:30Z
Connectors
| Connector | Health | Detail |
|---|---|---|
| simulation | healthy | 3 simulated tool(s) |
Framework mappings
| Framework | Edition | References | Reviewed | |
|---|---|---|---|---|
| NIST AI Risk Management Framework | AI RMF 1.0 (NIST AI 100-1, January 2023) | 17 | none | open |
Mappings ship as proposed, not reviewed. ARC’s engineers can draft one; only someone accountable for this organization’s compliance programme can accept it, and coverage counts only reviewed mappings — so the figure starts at zero and rises as real review happens.