Banking compliance pack — 5 min
Walks through the framework cards, drills into a PSD2 control, hits "evidence export" to render the auditor PDF, then opens the AUDITOR-role session.
Demos
Browse the screenshot tour, then pick the script that matches your audience.
Product demo
Code to production — the pipeline walkthrough
The scenario — one commit, end to end
Every demo follows the same real pipeline. It runs identically on GitLab CI, GitHub Actions, and
Azure DevOps, and against any of AWS EKS, Azure AKS, GCP GKE, or local k3d — the only thing that
changes is TARGET_CLOUD and the Fides environment name (<cloud>-karc-<env>).
- Commit + build. A change lands on the portal or podtato-head. CI builds the image,
pins the OCI digest, and opens a Fides trail for the pipeline run on flow
karc-pipeline. - Attest. Each stage writes a Fides attestation against that trail — artifact/SBOM (CycloneDX), the security scans (SAST, SCA, container, secret, IaC via Trivy/Grype/Checkov), and the deploy attestation. Evidence is hash-chained and tamper-evident, stored in the self-hosted Evidence Vault.
- Change-gate. At promotion the Fides change-gate scores the trail and returns a single
verdict (
approve/hold) plus a 0-100 risk score computed from the org's governance controls — no green light unless controls pass and a human approver signed off. - ServiceNow CR. SARC creates a Change Request carrying the Fides risk score
(
u_risk_score), the evidence chain link (u_fides_trail_url), and the SBOM + SARIF as attachments. Fides writes its verdict back as a work note — it advises, ServiceNow decides. - Approve. qa maps to a Standard Change that auto-approves when the score is within threshold; prod maps to a Normal Change that routes to CAB for manual approval. The approval policy reads the Fides score; it does not recompute compliance.
- Deploy. The gitops image tag is bumped and ArgoCD syncs the app. A PreSync Fides assertion + Kyverno policy gates (change-window, vuln SLO, license) run before the workload rolls.
- Snapshot + drift. Post-deploy, Fides snapshots the environment and watches for drift, and a PostSync DAST scan runs. The whole trail is one auditor-ready evidence pack.
By persona
General portal demo — 10 min
Multi-cloud, multi-CI pipeline + the karc-portal feature surface. Designed to follow a typical introduction to SARC.
Presentation deck — exec framing
Slide talking points for the 5-minute scene-setting before the live walkthrough. Covers the pain narrative, the three-layer architecture, and the demo agenda.
MCP Gateway runbook
Full operator runbook for the MCP-Client Gateway — agentic, permissioned, audited writes against GitHub via in-cluster sidecar. Includes the post-install bug log for first-time enablement.
By cloud target
AWS EKS
EKS cluster + IRSA + ECR + VPC endpoints. Full SARC stack including karc-portal + podtato-head. Cost ingest via AWS Cost Explorer.
Azure AKS
AKS cluster + Workload Identity + Key Vault. Azure-only parallel CI via Azure DevOps in addition to GitLab.
GCP GKE
GKE cluster + Workload Identity Federation + Secret Manager. GitHub Actions handles Terraform here.
Local k3d
Single-command local install for hands-on evaluation without any cloud cost. just demo-up-k3d brings the full SARC stack up on your laptop in 5 minutes.