I build Cerydora, a continuous authorization assurance product. It keeps control evidence current, time-bounded, and reviewable, so an authorization decision reflects the system as it is today, not what it looked like at the last assessment.
I work where public-sector compliance meets operations: NIST SP 800-53, IRS Publication 1075, and state control baselines on one side, and Microsoft security (Entra ID, Defender XDR, Sentinel, Intune) and AI-agent governance on the other.
These repositories are open, synthetic, and runnable. They contain no Cerydora application source, production algorithms, or real tenant data.
| Repository | What it shows |
|---|---|
| control-evidence-schema | A draft JSON Schema for time-bounded control evidence, with validation |
| public-sector-ai-controls | Machine-readable catalogs and candidate crosswalks: NIST AI RMF, 800-53, IRS 1075, Florida 60GG-2 |
| continuous-authorization-lab | How changing evidence changes a privileged-access review |
| ai-agent-governance-lab | Agent inventory and tool-scope review: identity, ownership, authority, evidence |
| security-control-detections | Control-oriented KQL for Microsoft Sentinel and Defender XDR |
How they fit together: the schema defines what evidence looks like, the catalogs define what it has to prove, the labs show decisions changing as evidence changes, and the detections show where that evidence comes from in Microsoft telemetry.
Issues and discussion are welcome on any of them. For Cerydora, see cerydora.com.