1. Athena AI · before
Access to the system is monitored via the SIEM. Users authenticate with passwords managed by the IT team.
Product momentWatch Athena get better, week over week.
Every reviewer correction is diff'd against Athena's original output, distilled into a learnings file, and re-injected into the next extraction. Scrub through three model versions and watch the same control go from generic to auditor-grade.
Model version
athena-extract-v2
14 weeks ago
- v2
- v3
- v4-learnings
Reviewer acceptance
68%
Avg token-Δ from human truth
41%
Checkpoint
1 / 3
Early extractor often confused "monitored" with "enforced". Reviewers had to rewrite control coverage language.
Reviewer correction diff for AC.L2-3.1.1 — Limit system access to authorized users
Control under review
AC.L2-3.1.1 — Limit system access to authorized users
2. Human reviewer · note
Monitoring is not access enforcement. Call out the IdP, MFA, and the deny-by-default posture explicitly.
3. Athena AI · next snapshot
Access to the system is enforced via Azure Entra ID with MFA. Deny-by-default policy is applied; SIEM provides post-hoc monitoring, not enforcement.
Token-level changes Athena learned
- removed: monitored via the SIEM
- added: enforced via Azure Entra ID with MFA
- added: deny-by-default policy applied
- kept: SIEM provides post-hoc monitoring
This loop runs continuously, on your evidence.
Upload a single policy and watch Athena turn it into a board-ready, SPRS-aligned snapshot in about three minutes. Every correction you make trains the next snapshot.