CheckPulse
Read your organization's governance shape across six primitives: identity, credentials, delegation, consent, authorization, and audit
Overview
CheckPulse rates your organization's agent-governance maturity across six primitives and renders the result as a radar chart: a six-spoke shape, not a score. There is deliberately no total and no percentage. The shape shows where each primitive sits today, and clicking a spoke shows exactly which criteria produced that position and what the next level would take.
CheckPulse lives in the left rail under See, at /dashboard/{orgId}/checkpulse. It is org-scoped: one shape per organization, covering every project.
CheckPulse is in limited preview while the current dashboard rolls out. If the page reports "CheckPulse not available", access has not been extended to your account yet.
The six primitives
Each spoke of the radar is one governance primitive. Reading clockwise from the top:
| Primitive | Question it answers |
|---|---|
| Identity | Can you tell who is calling? Measures organizational DID, agent identity, and reputation signals. |
| Credentials | Do you verify claims with cryptographic credentials? Measures VC-JWT issuance and verification. |
| Delegation | Can users grant scoped authority to agents? Measures delegation lifecycle and policy coverage. |
| Consent | Are users asked before agents act on their behalf? Measures consent configuration and exercised consent flows. |
| Authorization | Are there rules controlling what agents can do? Measures policy breadth and enforcement activity. |
| Audit | Can you prove what happened and when? Measures audit log volume, detection telemetry, and retention. |
How scores are produced
Every primitive scores an integer level from 0 to 4, mapped to a label:
| Level | Label |
|---|---|
| 0 | Nascent |
| 1, 2 | Emerging |
| 3 | Advanced |
| 4 | Mastery |
Scores come from a versioned rubric of objective, auditable criteria evaluated against your organization's live data. No level is awarded by judgment. When you open the page, the dashboard fetches a fresh report; the scoring service reads org-scoped facts straight from the platform's records and evaluates every rubric criterion as a pass or fail:
- Detection telemetry: total and recent (30-day) detections, distinct agent DIDs observed, active pixels
- Delegations: how many exist, how many are active, whether any carry VC-JWT credentials or revocation (StatusList2021) indices, whether any have completed a revoke or expire lifecycle
- Consent configuration: projects with a consent configuration, OAuth providers configured and connected, discovered tools
- Policies and enforcement: projects with enforcement-enabled policies, bouncer configs, custom reputation thresholds, populated allow or deny rules, high-confidence blocking
- Audit: admin audit log volume and recency, cryptographic bouncer proofs
A primitive's level is the highest contiguous level whose criteria all pass. Levels cannot be skipped: if level 2's criteria fail, level 3 cannot be awarded even if its own criteria happen to pass. The rubric carries a version stamp so historical reports remain interpretable after criteria change.
Integration tiers and gated spokes
Some levels are gated on your integration tier: the deepest Checkpoint integration your organization has installed. The ladder, from weakest to strongest signal:
| Tier | What earns it |
|---|---|
| none | Nothing installed |
| pixel | At least one active pixel |
| molti | At least one active KYA-OS deployment (for example a Molti governed agent) |
| middleware | Bouncer enabled, or a project policy enforcing |
| gateway | A project with a trusted gateway DID and gateway public key |
When a primitive cannot progress past its current level without a tier upgrade, its spoke renders dashed on the radar and its drill-in shows a Gated badge plus the specific upgrade that lifts the ceiling. For example, Delegation and Authorization cannot score above Nascent below the middleware tier, and Credentials requires at least the molti tier to reach Emerging.
Reading the shape
- Order: spokes run clockwise from the top: Identity, Credentials, Delegation, Consent, Authorization, Audit. Distance from the center is the level (0 to 4).
- Foundation floor: Identity and Audit are the foundation primitives. If either is at Nascent (level 0), a Foundation incomplete banner renders above the chart naming the blockers, and the shape emphasizes them. Everything else reads against this floor: raise the foundation to Emerging first.
- Emphasis: the scoring engine classifies the overall shape (foundation incomplete, tier gated, balanced at some maturity, or dominated by one strong primitive) and visually emphasizes the spokes most worth your attention for that shape.
- Dashed spokes: tier-gated, as above. The blocker is your integration depth, not a failed criterion.
- Narrow viewports: below tablet width the radar is replaced by ordered horizontal bars carrying the same data.
Drilling into a spoke
Click any spoke label (or bar) to open the criteria breakdown for that primitive:
- Why you're at this level: plain-language reasoning from the scorer
- Earned: every criterion currently passing
- To unlock: the criteria for the next level, each one concrete and checkable (for example "At least one active delegation currently holds a VC-JWT")
- For tier-gated primitives, the upgrade path that lifts the tier ceiling
Related reading
CheckPulse terms (primitive, level, Nascent through Mastery, foundation floor) are defined alongside the rest of the product vocabulary in the glossary. For the surfaces that feed the score, see Detect, Policies, and Managing Delegations.