# Control Matrix

Derived controls mapped from runtime analysis:

- retrieval filtering
- identity and capability enforcement
- tool authorization layer
- policy enforcement layer
- telemetry and audit hooks

These controls are framed as retrofit patterns rather than claims about upstream deployment defaults.