Execution surfaces
APIs, tools, payments, data export, infrastructure operations, and OT actions governed.
Authorization must exist where execution occurs. Procurement follows deployment risk, not seat volume.
Execution surfaces differ. Enforcement requirements do not. Teams progress by operational maturity.
Policies without enforcement are observability. Runtime control and receipts create operational trust.
Use this matrix to qualify enforcement readiness and assurance depth by operational stage.
| Capability | Dev / Starter | Production | Enterprise | Crit. infra |
|---|---|---|---|---|
| Governance controls | ||||
| Pre-execution authorization | Yes | Yes | Yes | Yes |
| Deterministic authorization | - | Yes | Yes | Yes |
| Fail-closed control | - | Yes | Yes | Yes |
| Policy enforcement engine | Yes | Yes | Yes | Yes |
| Verification and evidence | ||||
| Cryptographic receipts | Yes | Yes | Yes | Yes |
| Verification API | Yes | Yes | Yes | Yes |
| Deployment scope | ||||
| Multiple execution surfaces | - | Yes | Yes | Yes |
| CI/CD enforcement | - | Yes | Yes | Yes |
| Runtime integrations | Limited | Yes | Yes | Yes |
| Sovereign deployment | - | - | Yes | Yes |
| Air-gapped patterns | - | - | Optional | Yes |
| Support and compliance | ||||
| Compliance support | - | Yes | Yes | Yes |
| Dedicated support | - | Yes | Yes | Yes |
| Custom SLAs | - | Optional | Yes | Yes |
On smaller screens, secondary comparison rows are collapsed to prioritize procurement-critical controls.
Live procurement qualification signals that procurement, engineering, and risk teams evaluate together.