Coverage

Governance is only as good as its worst blind spot. A workspace with a perfect policy set and one uninstrumented Go service has a perfect policy set and a leak. So EgisAI models coverage explicitly: five surfaces, one control on each, and a page that tells you which ones are actually in place. The Coverage tab under Protection reports it, and the report you can hand an auditor is generated from the same numbers.

​

The five surfaces

​

Why the surfaces are listed even when empty

A coverage report that silently omits the surface it doesn’t cover is worse than no report. It reads as complete, and the one number an auditor would have asked about is the one that isn’t there. So every surface is returned on every read, including the ones with nothing deployed. A surface with no control says so, in words, with the name of the thing that would fill it.

​

Honesty about what each control did

Every audit row carries two fields that exist purely so a wall of verdicts can be read correctly months later:

• enforcement_status — enforced means we were in the path and the call went the way the row says. advisory means we saw it and did not gate it. An egress node in observe mode and the browser extension only ever write advisory, because neither stopped anything.
• inspection — full means policy ran on a real body. metadata_only means we saw a connection and never decrypted it, so any verdict on that row came from the destination or the volume, never the content. blind means it was reconstructed after the fact from a vendor’s audit log.

See the enforcement matrix for the per-framework version of the same question.

​

What’s next