Ask the Atlas: an interactive questionnaire over the knowledge base

It runs in your browser over a public sample of the atlas: 14 platforms and tools across all 44 controls, with 610 records and their sources. Each concern is routed to the controls it touches. The walk reads the record for every platform you picked, looks for alternatives where your stack falls short, and works out how each open control could be filled. Nothing you type leaves the page.

What it shows

• The walk as a network. Concerns lead to controls, controls to the platforms you run and to alternatives, and open controls to the ways they could be filled. Line styles show covered, in part, a real gap and out of scope.
• Gaps sorted properly. A control a product was never built for is not a gap in that product. Out-of-scope cells come from a scope list I accepted for each platform, and everything else is treated as a real gap.
• How sure each gap is. Real gaps carry a label for the checks they have survived: confirmed, likely, unchecked or disputed. Most are still unchecked, and the page says so.
• Seven ways to close a gap. Confirm it first, configure or upgrade what you already own, change policy, engineer it, adopt a tool, run it as a managed service, or accept the risk on the record. One is marked as the recommendation.
• A proposal at the end. A fixed-scope assessment, then only the workstreams your gaps call for, then rechecks as vendors ship, with the steps from a first call to a statement of work.
• Checked citations. Every claim names its record and source. Open any record for its verdict, gaps, sources and, for verified cells, the quoted passage with its page hash.
• The full version beside it. The model-written Client A run, routed by Haiku and answered by Sonnet through my local gateway, plays back through the same walk.

Why the gap labels are there

The atlas exists to find what a platform does not cover, because a gap is where the work is. So I tested the gaps. Research agents checked 24 of the atlas's not-addressed cells blind, without seeing the original answer, and only 16 held up. Most of the misses were about scope, where the control was never what the product is for. Seven turned out to be partial features the first research missed, several of them recent releases. One was a call I was certain of: LiteLLM is a gateway, yet its documentation now describes a Docker sandbox for running code you do not trust.

That changed how the atlas treats a gap. Each one is now labelled by how well it has been checked, rather than by a model's confidence score, and gaps are rechecked when a vendor's release notes change. The ladder on the page shows what those checks would do to your stack's gaps. Cells covered by that first blind check show what it actually found.

From gaps to a proposal

Someone hands me their stack, and the question is what they should buy from me, and in what order. The page answers it the way I would. It starts with a stack assessment that confirms each gap against the full atlas and their own configuration. Then it lists only the workstreams their gaps need, sized by how many gaps each one takes on: configure and harden, tool selection and procurement, control engineering, governance and policy, or managed assurance. Each workstream is its own statement of work. My packaged offerings are still taking shape, and what assessments like this turn up will decide them.

The live version routes by keyword and assembles answers from records without a model, so it costs nothing to run. The absence-check ladder is a simulation seeded with the rates from that first blind check. The workstreams are indicative. The atlas itself is closed source for now. Verdicts describe documented capability, not tested deployments.