Platform
The Terraform modules are one half of compliance.tf. The other half is the platform that decides which compliance posture a given team, project, and environment receives — and records why.
These pages describe that machinery in technical detail: the objects, the rules that govern transitions between them, and the guarantees that hold under concurrency and failure.
The model
An organization owns everything. Inside it, configs author compliance posture and freeze it into immutable snapshots, while projects organize workloads into three fixed environments. A binding connects one environment to one snapshot, and that binding is what the registry consults when a terraform init arrives.
Pages
| Page | Covers |
|---|---|
| Organizations and members | Personal and team organizations, aliases, membership, invitations |
| Projects and environments | Project structure, slugs, the three environments, protection, module aliases |
| Configs and snapshots | Authoring a posture, publishing, resolution, coverage |
| Promotion and gates | Bindings, the promotion gate, waivers, rollback |
| The audit trail | What the platform records when a posture changes, and how to read it back |
| Access control | Roles, permissions, segregation of duties, tenant isolation |
| Registry tokens | Personal and organization-owned tokens, revocation, Terraform wiring |
| Module request resolution | How a terraform init resolves to an enforced posture |
| Plans and entitlements | Tiers, trials, what gates on plan |
Where to start
If you are evaluating compliance.tf for a multi-team estate, read Projects and environments then Promotion and gates — together they answer whether the model fits how your organization already ships.
If you are already using compliance.tf and need to get a posture into production correctly, go straight to Promotion and gates.