Negative test · CMMC L2 / NIST 800-171 landing zone

One bad deploy vs. four gates

A single deployment carrying four deliberate violations — unencrypted database, world-open SSH, public bucket, plaintext load balancer. To reach production it has to beat four independent controls. Watch it beat none. Every line below is real output.

01
CIStatic analysis · Checkovpending
02
SCPPreventive · Org policypending
03
CONFIGDetective · Conformance packpending
04
AGENTAssessment · Grounding gatepending
four-gate-catch.cast REC 00:00
Gates fired4 / 4

One deliberate violation had to pass static analysis, a preventive org policy, runtime detection, and a grounded assessment to reach production. It was stopped four times. The last stop is the point: an LLM-based assessor that refuses its own confident-but-false “compliant” claim because the evidence doesn’t ground it — so the gap surfaces as not_met, not a rubber-stamped pass.

Provenance. All four gates reproduced live 2026-07-27 in a dedicated demo account under the org SCPs — Checkov exit 1 (25 failed); three verbatim SCP AccessDenied errors (nothing created); a fresh AWS Config recorder + restricted-ssh rule flagging the live open SG only; and the Claude Haiku 4.5 grounding judge (Amazon Bedrock) over Config evidence recorded 2026-07-26. All stood-up infra torn down the same session via the cui-lz-* break-glass role (Config Stop/Delete is itself SCP-denied). Synthetic app + evidence only — no client data.