GCP VPC Service Controls Perimeter
Perimeter posture, exception lanes, and evidence-routing for VPC Service Controls. Read-only operator surface over the GCP primitives — no production credentials, no actions, no decisions made on your behalf. Built for the conversation that happens before the action.
Active perimeters + posture
| Perimeter | Mode | Projects | Exceptions open | Last violation |
|---|---|---|---|---|
| prod-data-lake | enforce | 8 | 2 | 4d ago |
| prod-ai-training | enforce | 4 | 3 | 1d ago |
| audit-lane | enforce | 2 | 0 | none |
| regulated-prod | enforce | 5 | 1 | 8d ago |
| sandbox-ai-research | dryrun | 6 | 5 | 6h ago |
| sandbox-data-platform | dryrun | 4 | 3 | 12h ago |
| sandbox-shared | none | 3 | n/a | n/a |
Open exception lanes (sample)
| Lane | Project | Identity | Justification | Renewal |
|---|---|---|---|---|
| bigquery-dataset-export | prod-data-lake | sa-warehouse-export | monthly investor packet | 2026-07-15 |
| gcs-bucket-temp-restore | prod-ai-training | sa-restore-runner | Q2 restore drill | 2026-06-30 |
| cloud-build-egress | regulated-prod | cloudbuild | pre-prod base image fetch | 2026-08-01 |
| dataflow-job-debug | prod-data-lake | eng-debug | 7-day investigation window | 2026-06-10 |
What this is — and what it isn't
What it is: a read-only operator surface that sits next to GCP and answers the four questions every operating exec asks before they decide — what's open, who owns it, what's it cost, and where's the evidence. Synthetic data only — the structure is what's portable; the numbers in this preview are made up.
What it isn't: not a GCP replacement, not a control plane, not a write-path. The GCP platform stays the source of truth. This surface just makes the operating posture legible — to the operator, the auditor, the board — without forcing them to pivot through a vendor console first.
Compliance framing: readiness/evidence/posture/controls language only. Never "compliant" or "certified" — those words require an external audit and current attestation, which the surface itself does not provide.