PolicyTrace

PolicyTrace is a web app (with optional desktop agent) that continuously maps real-world system configurations to internal security policies and external compliance controls, then flags “policy drift” with evidence. Intelligence agencies often have policies that look perfect on paper but degrade across enclaves, contractors, and legacy systems; audits then become fire drills and exceptions become permanent. PolicyTrace ingests configuration snapshots, STIG/SCAP results, IAM exports, and change tickets, then produces a living control-to-evidence graph: what control is satisfied, by which system, with what proof, and since when. It prioritizes gaps by mission impact and blast radius, not generic CVSS. It also generates auditor-ready evidence packs and exception justifications with traceable sources. This is a combination traditional + AI app: AI is used to normalize messy evidence, summarize deltas, and draft remediation tasks, while all decisions remain reviewable and attributable.