The control is declared. How does it respond to a test?

We test a declared control on an agreed isolated copy. We apply a supported change and observe whether the control detects it or blocks the process, according to its expected behavior.

This is an assisted, pre-commercial service. Scope is limited to the implemented operators and self-assessment evidence, agreed before work starts. It is not generally available and not a self-service purchase.

Propose a control to verify

A test for your tests, and for the controls that claim to protect you.

The current implementation mutates an isolated copy and observes whether the declared control reacts. It is not a general testing method, not externally validated, and not demonstrated on customer production systems.

How the check runs

01
The technical contact confirms the control to observe.
02
The agreed isolated copy is fixed, before the change.
03
A controlled change alters only that copy.
04
You observe whether the declared control reacts, and the limits are recorded.

Two implemented mutation operators.

M1 — Declared critical file

Removes, in a test copy, a file confirmed as required by the technical owner. Observes whether the declared control detects its absence.

M2 — Policy changed without updating its digest

Alters, in a test copy, a policy with a declared digest-correspondence requirement. Observes whether the control detects the mismatch.

Example

In the demonstrated self-assessment profile, a mutation removes a required artifact or alters a policy digest in a controlled environment. Quvant observes whether the declared control detects the deviation. This is not a customer-production run.

Declared control

A policy whose declared digest must match the content. Supported operator: M2.

Change in the test copy

On the isolated copy, the policy is altered without updating the digest.

Behavior to observe

Whether the control detects the change or blocks the process, according to its expected behavior.

Limit of the result

This is an example of a test, not an observed outcome. It does not certify the control, generalize beyond the case, or use Quadriga.

What the customer receives

The declared control
The applied mutation
The observed behaviour
Test evidence
Verification limits
A suggested next step

Boundaries

The supported profile is mutation of an isolated copy against self-assessment evidence. External and commercial use is not tested. There is no action on the customer's production systems. The result does not extend beyond the control that was observed. A human stays in the perimeter and in the interpretation. It is not a certification of the control, and it is not a guarantee that the same outcome holds outside the observed case.