Posture Report
4 minute read
Overview
The trust ladder and domain overrides are controls. The posture report is evidence.
It captures the resolved state of your AI guardrails at a point in time, in a form you can hand to a security reviewer, attach to a compliance questionnaire, or file alongside a change record. Rather than describing your configuration in prose, you export what the platform will actually enforce.
Generate a report from the Create report menu in the Guardrails page header, on any Guardrails page. Reports you have already generated are listed on the Guardrails overview, each with its format and content hash.
Formats
| Format | Use for |
|---|---|
| JSON | Machine-readable review, diffing two exports, or feeding a compliance system. |
| HTML | Reading and sharing in a browser. |
| Attaching to a review, ticket, or audit record. |
Every format carries the same content, and every export is recorded as an EXPORT event in the audit feed.
What the report contains
Metadata. Report type and schema version, generation time, the organization, who generated it, and whether they authenticated as a user or with an API token.
Posture. The account trust level, whether autonomy is frozen, every domain override, and the effective level for each domain with the rule that decided it. This section also records governance settings that shape agent behavior: the default model, any forbidden models, and the per-day spending cap.
Domains. Each of the six domains with its effective level, whether an override is set, which connectors fall under it, and a rollup of how many tools are active, require approval, or are off.
Connectors. Every connector with its type, whether it is authenticated, and its full tool and capability inventory. Each tool records its domain, its trust-level policy, its effective state, and the reason for that state, for example frozen, domain_override, account_level, or unclassified. Each connector also reports classification coverage, so you can see how many of its tools have been classified into a domain.
Teammates. Each teammate with its status, model, and the connectors it can reach.
Review. The items worth a human’s attention: unclassified tools, unclassified capabilities, and domains whose override sits above the account level. This section is the fastest way to spot gaps, and it is the one to read first.
The connector and teammate inventories are deliberately unpaginated. A posture report that silently dropped connectors would be worse than no report at all.
Verifying integrity
A report is only evidence if a reviewer can tell whether it has been edited since it was produced. Each report carries a sha256 hash computed over its own content, along with the instructions for recomputing it.
The hash is calculated after the content is assembled and then attached to it, which is what makes the document self-verifying: a reviewer recomputes the hash from the file in front of them and compares it to the one the file carries. If a single character of the posture has been altered, the two do not match.
The hash also appears in the confirmation when the export completes, so you can record it in a ticket or change record alongside the file. That gives you an independent copy to check against later, which matters because someone who edits the document can recompute the hash inside it as well.
The integrity block records a content hash, and the HTML and PDF exports state “not signed, verify by content hash” in their footer. There is no signing key, so the hash proves the document is internally consistent, not that Edge Delta produced it. If your reviewers need proof of origin rather than proof of integrity, note the hash somewhere outside the document at the moment of export.
Suggested use
Generate a report:
- Before and after any trust level change, so the change record shows the before and after state.
- When onboarding a new connector, then read the review section to confirm its tools were classified.
- On whatever cadence your security review runs, as standing evidence of what your agents are permitted to do.
Because the JSON export is stable and machine-readable, diffing two exports is a practical way to answer “what changed in our AI posture last quarter.”
See also
- Guardrails for the trust ladder and the freeze control.
- Domain overrides for how effective levels resolve.
- Data boundary for the redaction policy the report records.