Sparta Durin
Read scoped AI governance evidence from Durin, with a separate review of policy suitability and audit-period coverage.
Issue the Sparta credential
This connector is available in customer v0.1.4 and current source-managed builds. Older v0.1.3 customer artifacts do not include it. Check release availability before issuing a credential.
A current Durin administrator opens Organization → Vanta → Sparta and creates a dedicated credential. Copy the origin, organization ID, environment and credential into Sparta's Durin connection.
The credential grants governance:read for GET /api/v1/integrations/sparta/evidence. It does not grant execution, policy-write or general administrator access.
Connect the issuing environment
- Open Integrations → Durin in Sparta.
- Select the issuing Durin deployment: production at
https://app.getdurin.comor staging athttps://moria.app.getdurin.com. - Enter the organization ID and select the issuing workspace's environment, Production or Sandbox. The deployment origin and workspace environment are separate settings; copy both from Durin.
- Paste the credential into Sparta credential, connect and run the healthcheck.
- Enable Durin sources on the relevant AI governance controls, then sync and review the retained results.
Organization, environment and origin must match the credential. A credential for another workspace does not establish production coverage.
Review the three checks
| Check | Coverage and limit |
|---|---|
| AI governance policy review | Reads current policy evidence and always requires review against the approved AI risk treatment. Configuration does not establish policy suitability. |
| Independent action approvals | Compares retained approval decisions with the independent-review requirement. No observed approvals require review. |
| Governed execution audit coverage | Checks retained governed executions for audit records. Activity outside Durin and full-period completeness require separate evidence. |
Activity checks cover a rolling 30-day window. Retain additional records for the full audit period. These results do not establish ISO/IEC 42001 conformance by themselves.
Rotate and separate SIEM delivery
The credential expires after 90 days. Rotate it in Durin and replace it in Sparta before expiry. Revoking the credential or removing its creator's administrator access stops collection immediately.
Durin's native SIEM destination is a separate pipeline. Connecting Sparta does not configure that destination. Elastic observations contain Sparta's check results and integration states; they do not replace Durin's native execution audit events.