Availability boundaries
- Exact product, engine, connection, evidence, region, retention, and supported-action coverage is confirmed for each customer environment.
- A connection category does not mean every provider service, record type, version, or response action is supported.
- Customer API access is available only when included for the deployment and documented for the agreed use case. Internal application interfaces are not public customer contracts.
- VFP pattern intelligence is presented as a controlled preview where it is included, not as a generally available capability for every customer.
Assessment boundaries
- Missing, stale, partial, degraded, or unconnected evidence is not proof of safety and should remain visible in the decision.
- A Nova compliance view organizes assessed evidence and gaps. It does not certify that an organization is compliant.
- Confidence and priority describe the current assessment. They are not guarantees and do not replace review of the supporting evidence.
- A RAZE attack scenario describes a possibility, not an observed attack. Check the linked evidence separately.
- AI-assisted analysis remains subject to available evidence, source health, customer scope, and human review.
Action and service boundaries
- A finding, score, recommendation, or AI-assisted conclusion does not authorize a change to a customer environment.
- Response actions depend on customer permissions, policies, approvals and the capabilities of the connected provider. Review the recorded result.
- Service status and urgent support paths can differ by deployment. Follow the information provided during onboarding or in the customer agreement.
- Public documentation does not contain detailed signed-in tasks, customer-specific settings, private access rules, or unpublished interfaces.