Skip to main content

Control Specification

The Control Specification defines the contract every control — built-in or custom — must satisfy. All contracts are expressed as Pydantic models, not YAML.

Data flow​

NimbusGuardResource  →  EvaluationInput  →  ControlOutcome  →  EvaluationResult
  • NimbusGuardResource — id, provider, resource_type, region, configuration{}, tags{}.
  • ControlOutcome — what a control returns: status, message, evidence.
  • EvaluationResult — what the Engine emits per resource/control pair.

Dispatcher gates​

Before running control logic, the dispatcher applies two gates:

  1. Resource type does not match the control → NOT_APPLICABLE.
  2. Required fields missing → NOT_EVALUATED.

:::danger Critical invariant NOT_EVALUATED and ERROR must never be silently converted into PASS. :::

:::warning Placeholder ⚠️ Add the full field-by-field schema reference for each model and the list of required fields per control category. :::