C4CI turns live Azure into C4 diagrams without asking for Contributor or Owner access. The platform is read-only by default, and the reviewed write path stays behind explicit human approval.
That keeps the first security conversation simple: least privilege for discovery, an immutable audit trail for control-plane changes, and a platform that helps teams prepare NIS2/DORA evidence without broad Azure permissions.
Reader role only — Azure discovery works without Contributor or Owner access.
Read-only first — the write path stays behind reviewed human approval.
Auditable by design — control-plane mutations are recorded in an immutable audit log.
C4CI is designed to make the access conversation easy. Discovery runs with Reader access only, and the platform stays read-only by default.
Buyers and auditors ask who approved a change, what changed, and when it happened. C4CI keeps that answer close to the product surface.
The trust story is not only about access control. Platform operations, recovery planning, and deployment guardrails matter too.
C4CI helps teams keep architecture evidence current: live diagrams replace stale documentation, drift detection shows where live Azure no longer matches the approved model, and higher tiers add exportable compliance reporting.
That supports audit preparation and procurement reviews. It does not replace your wider legal, governance, or operational compliance program.
Security reviews usually start with access, auditability, and how the platform behaves under change. Here is the short version.
| Buyer question | C4CI answer | Availability |
|---|---|---|
| Can we connect safely? | Yes. Azure discovery works with Reader role only, so teams do not need to grant Contributor or Owner access to get value from the platform. | All tiers |
| Can we prove what changed? | Control-plane mutations are recorded in an immutable audit log, and drift detection highlights where live Azure no longer matches the approved architecture. | Audit: platform-level. Drift: Pro+ |
| Can we export evidence? | Pro includes PDF and PlantUML exports. Enterprise and PAYG add compliance reporting designed for procurement reviews and audit preparation. | Pro+ exports. Enterprise/PAYG reporting |
| Can the platform change infrastructure by itself? | No by default. C4CI is read-only first, and the reviewed write path stays behind explicit human approval before any apply step. | Read-only default. Reviewed write path: Enterprise/PAYG |
Pro includes drift detection plus PDF and PlantUML exports. Enterprise and PAYG add compliance reporting and the reviewed write path.
No. C4CI discovers infrastructure with Reader role only. That means no Contributor or Owner access is required to generate diagrams or run the read-only discovery flow.
Discovery, diagram generation, and drift analysis are read-only. The write path remains a reviewed workflow: users see the generated OpenTofu changes and must approve them before any apply step.
Pro and above include drift detection plus standard exports. Enterprise and PAYG add compliance reporting and the reviewed write path for governance-heavy workflows.
No. C4CI helps teams build evidence for security reviews, procurement, and NIS2/DORA readiness. It does not replace your wider legal, governance, or operational compliance program.
Read-only first · Least privilege for Azure discovery · Contact us for security review