Review control coverage
Use control coverage to see how the installed integration handles each detected operation. Start with operations that are observed, unsupported, or unknown.
Each action you run through govern appears under its action name once VeriProof has recorded its policy check. Framework adapters add the model, tool, handoff, review, and output operations they report.
Read the counts
The counts come from what each released VeriProof package can actually do, not from what your application reported. Select a card to show only the operations in that group.
| Status | Meaning |
|---|---|
| Enforce | The integration supports applying policy decisions. Operation details identify the execution path and who applies the decision. |
| Observe | VeriProof records activity without controlling execution. |
| Not supported | The overlay does not provide this operation. |
| Unknown | Current evidence cannot establish coverage. |
The Enforce count includes direct controls, application-applied decisions, and paths that require a particular wrapper or cancellation behavior. Check those details for your workflow.
These counts describe integration support, not a count of blocked actions. Unknown operations are kept separate.
Which catalog applies to your version
Each operation is classified with the capability catalog for its SDK release. A patch release uses its minor version’s catalog. If there is no catalog for your exact version, VeriProof uses the newest catalog in the same minor version that isn’t newer than yours. For example, SDK 1.0.3 uses the 1.0.2 catalog if there is one, or the 1.0.0 catalog if not. When that happens, the operation says so, for example “Using the 1.0.0 catalog for SDK 1.0.1.”
A new minor version, such as 1.1.0, never uses the 1.0 catalog. Its operations show as Unknown until a catalog for that minor version is released.
Resolve a gap
- Open the affected operation.
- Confirm the detected SDK, adapter, version, and evidence time.
- Read the listed limitation. Add the required manual wrapper or move to a released action-owning adapter.
- Run one allowed action and one action denied before its protected effect.
- Check the application’s authoritative result to confirm that the denied action did not execute. Refresh coverage to inspect the new evidence.
Capability changes apply to new evidence. Earlier sessions keep the capability meaning recorded when they ran.