H33 HATS
SETUP WIZARD
Related · tier-1 reading. For the evidence chain that supports the claim, see Claims Evidence.
Tell us about your organization so we can configure your HATS deployment correctly.
HATS imports your organizational structure — users, roles, and MFA posture — to build the identity layer for governance.
Q-Sign enforces these rules cryptographically. No silent overrides. No bypasses.
HATS performs an initial sweep of your security control posture. Once your sources are connected, each observed control is recorded into cryptographically attested evidence.
Setup demonstration — this walkthrough sweep shows the flow using sample states until live sources are connected; it is a HATS recording step, not an independent verdict. Independent verification is a separate step at Verification.
HATS is continuously verifying. Q-Sign governance is cryptographically enforced.
Definition. Setup configures the sources HATS will record from — organization profile, identity provider, Q-Sign governance rules, and the controls to observe. HATS then records and monitors the operational evidence that those declared controls kept operating, over time, into a defined, replayable record. Setup connects the record; it does not itself render the verdict. Verification renders the independent verdict on an existing artifact; HICS assigns a maturity score; Agent-008 governs an AI agent's decision.
An organization profile, one identity provider connection, your governance rules, and the security controls to observe (identity, endpoint, backup, data protection, email, network). Why a distinct setup step: HATS can only record evidence about controls it has been pointed at, so setup establishes the sources before continuous recording begins. When not to use setup: if you need an outside party to render a verdict on an artifact that already exists, that is Verification; if you need a maturity grade of your program, that is HICS.
Completing setup starts HATS recording and monitoring operational evidence. The wizard's initial control sweep is a setup demonstration of the flow — it uses sample states until live sources are connected and is a HATS recording step, not an independent verdict. An independent, offline verdict that a recorded artifact reproduces is a separate step performed by Verification. Do not treat HATS monitoring as independent verification.
Owner: HATS standard (records/monitors operational evidence) · Evidence anchored on H33-74 · Independent verdict via Verification · Maturity score via HICS · AI-decision governance via Agent-008.