Engineering Controls
Engineering Controls are compliance controls implemented as enforced technical mechanisms — access configuration, encryption settings, pipeline gates, automated checks — that operate without human intervention and produce evidence of their operation.
Explanation
The opposite of an engineering control is an administrative control that relies on a person following a documented procedure. Engineering controls are preferred wherever possible because they are consistent, continuously evidenced, and fail visibly.
A mature Trust Infrastructure maximises engineering controls and reserves administrative controls for genuinely human judgment.
Why it matters
Engineering controls do not depend on memory or discipline; they hold at 3am on a holiday weekend, and they prove it.
How StackWeaver applies it
StackWeaver converts administrative controls into engineering controls wherever the framework and stack allow, raising both assurance and evidence quality.
What this relates to
- Compliance EngineeringTreating compliance as something built into systems through engineering — enforced, tested, and monitored — rather than added through documentation.
- Compliance-as-CodeExpressing compliance controls and policies as versioned, testable code in the engineering pipeline.
- Evidence-Native SystemsSystems where compliance proof is a property of how they operate — captured at the source — not a document produced under deadline.