Continuous Control Testing and Evidence Automation

A mature quantum platform does not wait for an annual audit to learn whether its controls still work. The platform tests controls continuously: identity controls, runtime controls, calibration controls, evidence controls, quota controls, cost controls, and provider-routing controls. Continuous monitoring is valuable because it provides visibility into assets, vulnerabilities, threats, control effectiveness, and organizational risk posture [R242]. For quantum platforms, that posture changes whenever a backend is recalibrated, a compiler target changes, a provider quota is consumed, or an evidence schema is revised.

flowchart LR
    Control[Control objective] --> Probe[Automated probe]
    Probe --> Observation[Observation]
    Observation --> Evidence[Evidence artifact]
    Evidence --> Decision{Control effective?}
    Decision -- yes --> Register[Assurance register]
    Decision -- no --> Issue[Risk or defect ticket]
    Issue --> Remediate[Remediation]
    Remediate --> Probe

Control probes

A control probe is a small, repeatable test that produces evidence. It should be narrow enough to run often and explicit enough to fail for a useful reason.

flowchart TB
    Probe[Control probe library] --> Identity[Identity probes]
    Probe --> Entitlement[Entitlement probes]
    Probe --> Calibration[Calibration probes]
    Probe --> Quota[Quota probes]
    Probe --> Evidence[Evidence probes]
    Probe --> Privacy[Privacy probes]

Evidence freshness

Evidence has a half-life. A control that passed last week may not still be effective after a provider API update, a new SDK version, a backend entitlement change, or a policy-as-code release. Continuous monitoring programs are assessed by looking at strategy, policies, procedures, operations, and analysis of monitoring data [R243]. The quantum adaptation is to include hardware, compiler, runtime, and experiment-evidence surfaces in that assessment.

sequenceDiagram
    participant Probe as Control probe
    participant Broker as Quantum broker
    participant Policy as Policy engine
    participant Store as Evidence store
    participant Risk as Risk register
    Probe->>Broker: Submit test workload
    Broker->>Policy: Evaluate entitlement and guardrails
    Policy-->>Broker: Decision
    Broker->>Store: Persist decision, context, and artifacts
    Store->>Risk: Open or update finding when probe fails

Control-state model

A control should not be represented as a static checklist item. It should have a state.

stateDiagram-v2
    [*] --> Proposed
    Proposed --> Implemented
    Implemented --> Probed
    Probed --> Effective
    Probed --> Degraded
    Degraded --> Remediating
    Remediating --> Probed
    Effective --> Retired
    Retired --> [*]

Quantum-specific drift

Classical platforms drift because configuration changes. Quantum platforms also drift because the physical system changes. A control probe that depends on hardware behavior needs to record the backend version, calibration timestamp, topology, basis gates, queue mode, mitigation profile, and measurement mapping.

flowchart LR
    Physical[Physical drift] --> Cal[Calibration state]
    Runtime[Runtime drift] --> API[Runtime API state]
    Compiler[Compiler drift] --> Target[Target model state]
    Policy[Policy drift] --> Guard[Guardrail state]
    Cal --> ProbeResult[Probe result]
    API --> ProbeResult
    Target --> ProbeResult
    Guard --> ProbeResult

Minimum viable control-evidence packet

Every probe result should contain:

• the control objective being tested
• the probe version
• the workload identity
• the runtime target
• the provider account or instance
• the decision outcome
• the exact evidence artifacts
• the remediation owner when failed

classDiagram
    class ControlProbe {
      id
      version
      control_objective
      schedule
      owner
    }
    class ProbeRun {
      run_id
      started_at
      backend
      runtime_mode
      outcome
    }
    class EvidenceArtifact {
      uri
      hash
      schema_version
      retention_class
    }
    ControlProbe "1" --> "*" ProbeRun
    ProbeRun "1" --> "*" EvidenceArtifact

Operating rule

Do not ask whether the quantum platform is compliant. Ask which controls were tested, how recently, against which backend and runtime contract, with what evidence, and what changed since the last passing probe.