← Back

Capabilities

Govern the software you are not allowed to modify

The systems most worth putting a control in front of are usually the ones you cannot edit: a vendor product, a closed integration, an agent framework somebody else maintains.

Every guide to adding an approval step assumes you own the source. The software that worries your risk committee is usually the software you bought, and the vendor's roadmap for the control you want is not your roadmap.

Bought product
no source access
Egress boundary
the control sits here
Destination
api.partner.com
calls →
asks a person →
← result
What you changed
Nothing
One policy
Nothing
Fig 09AThe control sits outside the software you cannot change.

What it changes for the business

  • You stop waiting on a vendor. A control your supplier has no plans to build becomes something you apply this quarter, without their agreement.
  • Third-party tools become deployable. The purchase that stalled because it could act without oversight can go ahead with oversight you added yourself.
  • No integration project. There is nothing to build into the product, so the cost is a policy change rather than an engineering commitment.
  • One control across everything. The same rule covers bought software, your own services and agents, so there is one thing to explain to an auditor.

How it works, briefly

The control sits where the software's outbound calls already leave your environment, so nothing has to be added to the software itself. The person asked sees what was really requested, described in plain language, rather than a summary the calling system supplied about itself.

How this is handled elsewhere How Squidder does it
Build approval into the application Nothing added to the application
Wait for the vendor to ship the feature Applied without the vendor
Wrap it in a workflow tool it must call Works whether or not it cooperates
Trust the calling system's description Reconstructed from what it actually sent
One control per product, each different One control across every product
What the product said
“Sync records with partner.”
supplied by the calling system
about itself
What it actually sent
Export 4,210 customer records (name, email, phone) to api.partner.com
reconstructed from the request
the person sees this one
Fig 09BWhat the product claimed, against what it sent.

Where it fits, and where it does not

Something with no person behind it cannot be asked. Unattended machine traffic needs a policy decision instead, which is a different control and is treated as one rather than pretending software can consent on a person's behalf.

Where to start

Pick the bought product your security team is most uncomfortable with. Put a control in front of one destination it calls, change nothing about the product, and see whether the discomfort survives.