Portal tour

The SARC portal is the human-facing layer above Fides + ServiceNow + your CI + your cloud. Every change moves the same way: a commit builds Fides attestations (artifact/SBOM, security, deploy), the Fides change-gate scores the trail and returns a compliance verdict, a ServiceNow Change Request is created carrying that risk score plus the SBOM/SARIF evidence, qa auto-approves when compliant while prod goes to CAB, then ArgoCD deploys and Fides snapshots the environment. Below: every operator surface that exposes a step of that flow, grouped by purpose. Click any screen for the full-resolution view.

37 screens · grouped into 8 categories · watch the product demo + code-to-prod walkthrough for video.

Overview

The first three screens an operator sees on login — top-level posture, environment status, and DORA-style delivery metrics.

**Operator dashboard** KPI tiles for CR throughput, vuln backlog, evidence freshness, and incident status.

**DORA metrics** Lead time, deploy frequency, MTTR, change-fail rate. Computed nightly via CronJob.

Pipelines, CRs, change windows

How software actually ships. Multi-CI pipeline view, ServiceNow CRs enriched with the Fides change-gate risk score + evidence, change-window enforcement at deploy time.

**Change requests** ServiceNow CRs enriched with the Fides risk score (u_risk_score), SBOM, SARIF, and the Fides trail snapshot. qa auto-approves when compliant; prod goes to CAB.

**Change windows** Calendar-synced (M365 + Google Workspace) approved-deploy windows. Enforced at the ArgoCD PreSync hook.

**Problems** ServiceNow Problem table — correlated with services, CRs, and incidents via the service graph.

**Issue sync** Three-way mirror: GitLab issues ⇄ GitHub Issues ⇄ ADO work items. Configured per-tenant.

Service catalog + graph + teams

The CMDB-style view of what runs where, who owns it, and how services depend on each other. Powers incident-to-service correlation.

**Service graph** Directed dependency graph. Drives the service-to-incident correlation that ServiceNow can't compute natively.

**Teams** Service ownership rolled up to teams for chargeback + escalation routing.

SBOM + vulnerabilities + scans

Vulnerability + supply-chain surface. Built on Fides attestations + GitLab Security scanners + Trivy + Grype + Checkov.

**SBOM browser** CycloneDX SBOMs per component. Drill into a component to see license + provenance + cross-service usage.

**Vulnerabilities** Redesigned 7-col table — combined SLA cell, KPI tiles, URL-persisted filters, drawer with CVE/NVD/OSV links.

**Vuln SLO burndown** SLO-style burndown across SLA tiers. Cost-vuln correlation badge on each row.

**Security scan runs** Per-pipeline scanner status across SAST, DAST, container, secret, dep, and IaC scanning.

Compliance + risk + controls + evidence

The auditor-facing surface. Framework cards, the 5-axis risk score, control mapping, policy gates, the Fides ground truth, and one-button evidence export.

**Compliance dashboard** Coverage cards per framework: SOC 2, ISO 27001, DORA, PSD2, NIST 800-53, PCI-DSS, SOX.

**Control mapping** Phase A/B/C redesign: KPI strip, evidence table, 8-group cross-link sidebar, window picker.

**Kyverno policies** PreSync policy gates enforced by ArgoCD. License compliance, vuln SLO, change-window enforcement.

**Fides integration** Live view of the self-hosted Fides ledger — attestations + trails + env snapshots. Quick drill from CR -> trail -> attestation -> evidence.

**Evidence export** One button: SOC 2 / ISO 27001 / DORA / PSD2 / NIST evidence pack PDF. Time-window bounded.

CMDB + releases

What we pushed into ServiceNow CMDB. Service catalog walk back into ServiceNow CIs, with the release-notes browser on top.

**CMDB browser** CMDB CIs as pushed by SARC: cmdb_ci_service, cmdb_ci_deployment, OpenShift Build -> BuildConfig -> ImageStreamTag -> Routes.

Clusters, GitOps, timeline, Tekton, costs

Day-to-day ops surface. Multi-cluster view, ArgoCD app status, real-time SSE timeline, optional Tekton dashboard, FinOps roll-up.

**Clusters (multi-cloud)** AWS EKS + Azure AKS + GCP GKE + local k3d + ROSA OpenShift (read-only). Per-cluster health + capacity.

**Real-time timeline** SSE-driven activity stream — every CR, every deploy, every audit event, live.

**Performance** Cluster + workload performance snapshot. Lightweight — opt-in per tenant.

**Tekton dashboard** Live PipelineRun status via SSE + per-step log streaming. Trigger button ADMIN-gated.

**Cost dashboard** Per-service cloud cost + per-team chargeback + right-sizing recommendations + cost-vuln correlation.

Audit, users, notifications, settings

Admin + auditor surfaces. Hash-chained audit log, AUDITOR role with magic-link, notification routing, tenant configuration.

**Users + roles** AUDITOR role (time-boxed magic-link, no SMTP needed). Tri-tab create modal: manual / invite / CSV.

**Notifications** Per-tenant routing rules — Slack, Teams, email, ServiceNow, custom webhooks.

**Settings (overview)** Tile-based settings grid: integrations, frameworks, agents, observability targets, billing.

**Settings — AI** Multi-provider LLM: Anthropic / Azure OpenAI / Bedrock / Vertex / on-prem. Per-tenant key.

**Settings — Agents** AgentRecipeBinding per CI (GitLab + GitHub + ADO). Recipes: vuln-suggest-fix, problem-investigate, right-sizing-apply.

**Settings — Tekton** 10 cols across 5 cluster targets for Tekton-on-Kubernetes wiring.

**Help + docs** In-portal help surface — quick links to runbooks + the AUDITOR onboarding flow.

Want to talk through what you see?

The demo scripts walk through compliance-director, CTO, and CFO talk tracks against this same portal. The getting-started guide shows how to bring the same portal up in your own cloud in under an hour.