Use case · Secure Coding

Code verification tied to approved intent.

Requirements from design review and threat modeling are tracked through implementation and validated against pull requests with attached evidence.

The queue

Requirements that stay attached to delivery.

Verification status updates as code evolves, giving teams a shared view of what is unresolved, partially complete, and fully verified.

Verification Queue
Live
Pending fix5
REC-F19-R01
Tamper-evident audit log
REC-F18-R01
Per-tenant IAM scoping
Missing2
REC-F11-R02
Webhook signature check
Partial3
REC-F07-R01
RBAC on endpoints
REC-F09-R01
Egress allow-list
Verified10
REC-F02-R01
Parameterised queries
REC-F03-R01
TLS 1.3 enforced
REC-F19-R01 · Pending fix
Detail
i
Tamper-evident audit log w/ chain hash
THREAT MODEL
Libraries: crypto/hmac · crypto/sha256. Store the HMAC signing key in Secrets Manager; rotate every 90 days. Retain records per the 7-year compliance policy, soft-archival only.
Parent KAN-7 · Child KAN-53
RUN VERIFY
Evidence, not assertions

Decisions backed by implementation evidence.

Each requirement includes expected implementation evidence, and verification reruns as code changes to keep decisions current.

See how gates enforce it
What it does

Close the loop from approved intent to merged code.

Bi-directional traceability

Each requirement links to its source finding, PRs, and Jira tickets.

Four states, continuously updated

Pending fix, missing, partial, and verified, updated automatically as PRs merge.

Reference implementations

The agent specifies the libraries, config and code shape it expects, then checks the real diff against it.

Run on demand

Trigger verification per requirement, or let it re-evaluate continuously as code lands.

Export & report

Filter by source, app or component; export the queue as CSV for evidence.

Webhook-native

PR activity flows in over webhooks, no polling, no manual status updates.

18
Requirements tracked
10
Verified this run
2
Items needing follow-up
88%
Coverage on merged PRs (pilot)
Get in touch

Design becomes policy.
Policy becomes the gate.

See how approved requirements become enforceable release control on your own stack.