Continuous Control and Secure-by-Design Templates

This appendix provides copyable templates for the control and secure-design machinery introduced in chapters 179 and 180.

Control probe manifest

Illustrative listing · yaml

probe_id: qcp.identity.expired-token-denial
version: 1.0.0
control_objective: reject expired workload identities
owner: platform-security
cadence: hourly
runtime_targets:
  - broker-production
evidence:
  required:
    - policy_decision_log
    - broker_rejection_event
    - trace_id
expected_outcome: denied
failure_action:
  severity: high
  create_ticket: true
  notify:
    - platform-security
    - quantum-ops

Diagram loads as you read

Control probe manifest · Figure 1

View diagram source

flowchart LR
    Manifest[Probe manifest] --> Runner[Probe runner]
    Runner --> Broker[Broker]
    Broker --> Evidence[Evidence store]
    Evidence --> Finding{Pass?}
    Finding -- no --> Ticket[Issue ticket]
    Finding -- yes --> Register[Control register]

Control result schema

Illustrative listing · yaml

probe_run_id: qcp-run-2026-04-20-001
probe_id: qcp.identity.expired-token-denial
probe_version: 1.0.0
started_at: 2026-04-20T17:00:00Z
completed_at: 2026-04-20T17:00:02Z
outcome: pass
target:
  environment: production
  broker_version: 24.6.1
  policy_bundle: quantum-opa-18
evidence:
  - uri: s3://evidence/qcp-run-001/policy.json
    sha256: example
  - uri: s3://evidence/qcp-run-001/trace.json
    sha256: example

Secure design review template

Illustrative listing · yaml

review_id: qsd-compiler-plugin-042
change_title: add hardware-aware routing plugin
owner: compiler-platform
threat_model_required: true
data_classes:
  - public-benchmark
  - internal-research
security_questions:
  - can the plugin access credentials?
  - can the plugin change measurement mapping?
  - can the plugin bypass evidence validation?
  - can the plugin exfiltrate workload metadata?
quantum_questions:
  - does the plugin preserve circuit semantics?
  - does it change depth or two-qubit gate count materially?
  - does it require a target-model version bump?
  - does it need a compatibility window?
approval:
  required_approvers:
    - quantum-ops
    - security
    - compiler-owner

Diagram loads as you read

Secure design review template · Figure 2

View diagram source

sequenceDiagram
    participant Author as Change author
    participant Security as Security reviewer
    participant Quantum as Quantum reviewer
    participant Ops as Ops reviewer
    participant Registry as Release registry
    Author->>Security: Submit design review
    Author->>Quantum: Submit quantum impact
    Author->>Ops: Submit rollback plan
    Security-->>Registry: security approval
    Quantum-->>Registry: technical approval
    Ops-->>Registry: operating approval

Secure-default checklist

Check	Required result
workload identity required	yes
anonymous execution disabled	yes
provider credentials hidden from users	yes
evidence package required	yes
plugin sandbox enabled	yes
rollback path tested	yes
dependency provenance available	yes
PQC inventory status known	yes

Diagram loads as you read

Secure-default checklist · Figure 3

View diagram source

flowchart TB
    Checklist[Secure-default checklist] --> Identity[Identity]
    Checklist --> Credentials[Credential isolation]
    Checklist --> Evidence[Evidence]
    Checklist --> Plugin[Plugin sandbox]
    Checklist --> Rollback[Rollback]
    Checklist --> Provenance[Provenance]

Exception record

Illustrative listing · yaml

exception_id: qex-2026-041
control: evidence.package.required
requested_by: research-team-alpha
reason: legacy benchmark cannot produce full package
risk: comparability and audit gap
compensating_controls:
  - manual reviewer signoff
  - raw provider result retained
  - one-time execution window
expires_at: 2026-05-20T00:00:00Z
approvers:
  - quantum-ops
  - platform-risk