## SOC 2 audit prep takes 180 hours.
60% is proving "who approved what."

63% of security incidents trace to config drift
from a known-good state.

The problem isn't missing policies. It's proving you enforced them.

180 hours: Based on industry surveys of Series B-D companies going through SOC 2 Type II. 60%: Most time is spent on "audit archaeology" - reconstructing who approved what. 63% stat: Industry data on security incidents caused by configuration drift. The hook: Security teams have policies. The problem is proving enforcement with provenance.

## Why this keeps happening

- AI generates code that looks correct but violates your internal policies
- Staff engineer's "best practices" wiki is ignored by new hires
- "Who approved this exception?" → dig through Slack for 3 hours

Your security team writes policies. Nobody can prove they're followed.

AI code generation: Copilot/ChatGPT code often includes InsecureSkipVerify, weak crypto, etc. Wiki problem: Institutional knowledge trapped in documents nobody reads. Slack archaeology: The audit trail exists, but it takes hours to reconstruct. Marcus's pain: He's been burned by shelfware. He needs proof, not promises.

# Aphoria

Code-level truth linting. Claims, not rules.

Validate code against authoritative sources with cryptographic provenance.

"Aphoria" = Greek for "bearing away uncertainty" "Claims, not rules" = We don't pattern match. We validate against authoritative sources. Cryptographic provenance = Ed25519-signed Trust Packs trace every policy to an approver. Keep this slide brief - the next one explains the approach.

## Every policy has a source

Aphoria stores authoritative claims with provenance, not regex patterns.

- Cryptographic attribution: Ed25519-signed Trust Packs trace every policy to an approver
- Sub-second scanning: <100ms pre-commit, <1s full scan. Developers won't disable it.
- AI guardrails: Catch `InsecureSkipVerify = true` before the PR

Cryptographic attribution: Not "the linter said so." Trust Packs are Ed25519-signed with issuer provenance. Sub-second: <100ms for staged files, <1s for full scan. Fast enough for pre-commit. Developers won't bypass it. AI guardrails: Copilot generates insecure code. This catches it instantly. Key differentiator: Every violation traces to a signed Trust Pack, not a regex rule.

## What this enables

#### Policy Governance

Security team publishes once. 400 engineers inherit instantly.

#### Drift Detection

"TLS config changed from 1.3 to 1.2" - caught before production.

#### Compliance Export

SOC 2 evidence in 15 minutes, not 3 days.

Every exception tracked with reason and timestamp.

Policy Governance: No more "update 50 repos" - publish to StemeDB once, all scans use it. Drift Detection: --persist mode tracks changes between scans. See what drifted. Compliance Export: JSON output with full provenance. Feed it to your SOC 2 report. Exceptions: Not .sonar-ignore. Tracked acknowledgments with reasons and timestamps.

## Here's what it looks like

Terminal:

$ aphoria scan
BLOCK code://go/auth/tls/cert_verification
Your code: TLS certificate verification is disabled (main.go:12)
Regulatory: Boolean(true) (Tier 0)
Action: Fix or acknowledge with: aphoria ack <path> --reason "..."

I'm going to run this exact command live...

This is the transition slide. Show them what they're about to see. Key points to emphasize: - BLOCK status with clear subject path - "Your code" vs "Regulatory" - the conflict is explicit - Action line shows how to handle exceptions - When Trust Pack imported, policy source also shown Then switch to terminal for the live demo.

## Questions

What you saw:

- Speed - <100ms staged, <1s full scan, fast enough for pre-commit
- Attribution - Every policy signed by an approver
- Acknowledgments - Exceptions tracked, not ignored
- Drift Detection - Config changes caught before production
- Compliance Export - SOC 2 evidence in 15 minutes

Be ready for: - "Why not just write better Semgrep rules?" → Semgrep can't track who approved exceptions - "What's the false positive rate?" → We check against authoritative sources, not patterns - "I already have pre-commit hooks" → Hooks catch violations. Aphoria proves who approved the policy - "SOC 2 certified?" → In progress. But you can generate the evidence today - "Why not Postgres?" → You could build this. 6-9 months, 2-3 engineers. We've done the hard work