# Compliance controls

> Compliance frameworks and their controls, evidence linked to controls (attachments or notes, with a validity date), recurring evidence tasks with assignees and an overdue state, a status rollup per framework, and policies published as frozen versions that members acknowledge.

- Category: Admin & compliance
- Module: `controls`
- Modes: `managed`, `custom`
- Docs: https://bettersupabase.com/docs/blocks/controls
- Page: https://bettersupabase.com/blocks/controls

## Install

```bash
npx better-supabase add controls
```

The command also installs `updated-at`, `tenant`, `access`, `versions`.

## Configure

Add the block to `better-supabase.config.ts`:

```ts
import { defineConfig } from "better-supabase/config";

export default defineConfig({
  blocks: {
    // Required by controls; add installs them too.
    "updated-at": {},
    tenant: {},
    access: {},
    versions: {},
    // Modes: "managed", "custom". The default is "managed".
    controls: { mode: "managed" },
  },
});
```

## Client

The block has no React entry yet. Its server-side TypeScript is in `better-supabase/blocks/controls`.

## Events

- `control.evidence_added`
- `control.saved`
- `evidence_task.missed`
- `policy.acknowledged`
- `policy.published`

## Related blocks

Requires: [tenant](https://bettersupabase.com/blocks/tenant.md), [access](https://bettersupabase.com/blocks/access.md), [versions](https://bettersupabase.com/blocks/versions.md)

Works with: [attachments](https://bettersupabase.com/blocks/attachments.md), [notifications](https://bettersupabase.com/blocks/notifications.md), [outbox](https://bettersupabase.com/blocks/outbox.md), [audit](https://bettersupabase.com/blocks/audit.md)

## Recipes

- [Control posture](https://bettersupabase.com/recipes/control-posture.md): One card per compliance framework with its passing, failing and not started controls, then the overdue evidence tasks.