ACSE
An autonomous CSPM agent that scans AWS, Azure, and GCP for misconfigurations, writes and tests its own policy, scores blast radius, and remediates with Terraform — under a human approval gate.
ACSE is a cloud-security-posture product built on UAP. A traditional CSPM tool flags findings and leaves the fixing to you. ACSE closes the loop: it authors Rego policy from your standards, tests that policy before it goes live, scores the blast radius of a proposed fix, and prepares a Terraform remediation — auto-applying low-risk changes and pausing anything high-risk for human approval. It is the in-house, no-black-box alternative to renting a cloud-security product.
What it does
Multi-cloud scanning
Connectors continuously scan AWS, Azure, and GCP accounts for misconfiguration and risk.
Policy authoring (RAG → Rego)
A Claude Sonnet PolicyAuthor drafts Rego policy grounded in your standards and context.
Self-testing policy
Generated policy is validated with OPA test cases on LocalStack before it is ever enforced.
Blast-radius review
A reviewer combines Semgrep with a 1–10 blast-radius score to quantify the risk of each fix.
Terraform remediation
Fixes are written as infrastructure-as-code — low-risk changes auto-apply, high-risk pause for approval.
Compliance mapping
Policies map to CIS, SOC 2, PCI, and HIPAA, exposed through a compliance-score API and dashboard.
- 1
Scanner
Pulls findings from the AWS, Azure, and GCP connectors.
- 2
PolicyAuthor
Sonnet drafts Rego policy via RAG over your standards.
- 3
Tester
Runs OPA test cases on LocalStack to prove the policy holds.
- 4
Reviewer
Semgrep plus a 1–10 blast-radius score assess the fix.
- 5
Remediator
Writes a Terraform fix; low-risk changes auto-apply.
- 6
Approval gate
A blast radius at or above threshold pauses for a human.
Design targets from the product roadmap.
In development on UAP, following the roadmap: cloud connectors, policy authoring and testing, blast-radius review, and Terraform remediation behind an approval gate — with a compliance-score API and a React approval dashboard, and a fine-tuned Llama 8B running in shadow mode.
Good questions.
How is this different from a traditional CSPM tool?
Traditional CSPM flags problems. ACSE closes the loop — it writes and tests policy, scores blast radius, and remediates via Terraform, with humans approving anything high-risk.
Will it change my infrastructure without approval?
Only low-risk fixes auto-apply. Anything with a blast radius at or above the threshold pauses for human approval, with the full plan trace attached.
Do we own it, or is it a black box?
You own it. ACSE runs on UAP in your own cloud — the policies are Rego you can read and the fixes are Terraform you review.