Authpermit Legal, product planes and posture by domain

Authpermit determines the security facts; Incredible Attorneys determines the law. Authpermit Legal keeps the operational obligation — what may be owed, to whom, by when, and where it stands — and labels every one a potential obligation, not legal advice. Console: GRC → Legal obligations (/app/legal). The legal plane is included in Enterprise and Sovereign, or as an add-on.

From incident to obligations

An incident is assessed when it is declared as a data_breach or marked reportable (with a legal profile: POST /api/v1/legal/profile/update), or on demand (POST /api/v1/legal/assess with incident_id, jurisdictions, triggers such as personal_data, health_data, essential_service, public_company, and optionally affected_count and aware_at). A state or province also matches its country (US-CA → US), a member state the EU. Matching rule rows — GDPR Art. 33/34, NIS2 Art. 23, UK GDPR, HIPAA, SEC Form 8-K Item 1.05, California, New York, PIPEDA, Quebec Law 25, Ontario PHIPA, Australia's NDB scheme, Brazil's LGPD — become obligations with deadlines counted from awareness (business days skip weekends but not holidays, so the real deadline may be later). The seeded rows were assembled from public sources and say reviewed: false until a qualified person stamps them (GET /api/v1/legal/rules).

Then Authpermit looks the authorities up at Incredible Attorneys (only the jurisdiction and a fixed phrase are sent, never incident data; an empty answer is a coverage gap, not the absence of law), places a legal hold on the incident's evidence (turn off with auto_hold), marks the incident reportable, and starts the deadline ladder.

Deadlines

T-24h, T-6h and T-1h emit legal.deadline.approaching; the deadline itself legal.deadline.missed (critical). People are woken by the AI Monitor's escalation ladder — the on-call rota's primary, secondary and commander, category legal, or the organization's owners and admins when no rota exists. Acknowledging an obligation quiets T-24h and T-6h; T-1h and the deadline always escalate. Record it as met (/fulfil: a regulator notification also records the report on the incident) or, as a person and with reasons, judge it not applicable (/dismiss).

Law changes

Every hour Authpermit reads Incredible Attorneys' LawPulse feed; a change in a jurisdiction you operate in, or with an open obligation, emits legal.law.changed and flags the obligations it may touch (GET /api/v1/legal/law-changes).

Planes

Authpermit is sold as six product planes over one shared security fabric: Identity & Zero Trust, Security Operations, Exposure & AppSec, Cloud, Endpoint & Data, AI & Autonomous Defense and Governance, Risk & Compliance (with the Legal add-on). Assets, incidents, risk, policies, automation, the graph and evidence are in every plan. A plane gates its console pages; existing API, MCP and webhook integrations are not gated by plane. Every organization that existed before planes were introduced kept all six. GET /api/v1/billing/planes says which you have and why; console /app/planes.

Posture by domain

GET /api/v1/posture (scope risk:read) and the Command Center (/app/command-center): a 0–100 score per domain — identity, endpoints, cloud, applications, data, AI, exposure, compliance, legal — with what it was computed from, the domains not assessed and why, and the top risks across the platform. Not one number on purpose.

API and MCP

GET /api/v1/legal/obligations, /legal/rules, /legal/jurisdictions, /legal/law-changes, /legal/authorities, /legal/counsel, /legal/profile (scope legal:read); POST /api/v1/legal/assess, /legal/obligations/{id}/acknowledge, /fulfil, /dismiss, /legal/profile/update (legal:manage); POST /api/v1/incidents/{id}/reportable and /report (incident:manage). MCP tools: authpermit_legal_obligations, authpermit_legal_assess, authpermit_legal_obligation_acknowledge, authpermit_legal_rules, authpermit_legal_jurisdictions, authpermit_legal_law_changes, authpermit_legal_authorities, authpermit_legal_counsel, authpermit_legal_profile, authpermit_legal_profile_set, authpermit_incident_mark_reportable, authpermit_posture_domains, authpermit_billing_planes, and — always with a person's approval — authpermit_legal_obligation_fulfil, authpermit_legal_obligation_dismiss, authpermit_incident_record_report. AuthpermitTAG's GRC analyst reads an incident's obligations as one of its skills.