Skip to main content

VCAL Compliance

VCAL Compliance is an optional commercial module that evaluates retained VCAL Audit evidence for governance, control assessment, reporting, and compliance workflows.

Unlike Privacy Guard and Security Guard, Compliance is not in the synchronous AI Firewall request path. It works downstream of VCAL Audit and does not add latency to normal AI Firewall request processing.

Integration point​

AI Cost Firewall
  -> VCAL Audit
  -> VCAL Compliance

VCAL Compliance consumes retained evidence from VCAL Audit rather than receiving evidence directly from AI Cost Firewall.

AI Cost Firewall does not require a direct compliance_* directive. Confirm Audit ingestion first, then confirm that Compliance can reach and synchronize with the Audit service.

Service checks​

In the validated local stack, VCAL Compliance runs on port 8093 and connects to VCAL Audit over the shared Docker network.

curl http://localhost:8093/healthz
curl http://localhost:8093/readyz
curl http://localhost:8093/metrics
curl http://localhost:8093/version

/healthz reports process health. /readyz also checks runtime readiness and access to the Compliance SQLite store, so it can return 503 Service Unavailable while the service is shutting down or if the store is unavailable.

Evidence synchronization​

Compliance synchronizes retained Audit events in batches and records the last imported Audit sequence.

Synchronization includes bounded retry and backoff for transient Audit dependency failures such as connection errors, timeouts, HTTP 429, and HTTP 5xx responses. Unsupported evidence schema versions are rejected rather than silently imported.

AI Cost Firewall request traces can terminate with either:

request.completed

or:

request.failed

Both are valid terminal outcomes in the current evidence lifecycle and can be used by Compliance controls that assess terminal-event coverage.

Licensing and feature access​

Compliance validates its signed license during startup. Licensed capabilities can independently enable or disable functions such as:

  • Audit synchronization
  • activity summaries
  • control assessment
  • framework mappings
  • report generation
  • evidence packages
  • trace queries

Deployment-bound licenses require the configured Compliance deployment ID to match the deployment ID signed into the license.

Licensed limits can also constrain report generation and retention behavior.

Operational behavior​

The hardened service uses SQLite with a configurable busy timeout, isolates blocking database work from async request handling, and supports graceful shutdown.

Periodic Audit synchronization is started only when the licensed audit_sync capability is enabled. During shutdown, readiness is withdrawn before the service completes graceful termination.

See VCAL Audit and Troubleshooting.

note

This page intentionally provides only the AI Cost Firewall integration context. Full Compliance control definitions, framework mappings, report workflows, evidence packages, licensing, and operational administration are documented separately.