Skip to main content
When you create a release, your control plane compiles your origin stack into two artifacts: a deployment stack that gets applied into the customer’s appliance, and an audit stack that is produced for the customer to review. The audit stack exists so that customers can satisfy their own security, policy, and compliance review before any Tensor9 BYOC-managed infrastructure is applied in their environment.
The audit stack is for your customer to read, and it contains no analysis of its own: no findings, no pass or fail, no adaptation report. To find out what in your stack will and will not adapt onto a target cloud, compile it with tensor9 compile, which reports every issue by severity without deploying anything.

​
What’s in the audit stack

The audit stack describes the same application infrastructure as the deployment stack, but with the Tensor9 BYOC runtime plumbing stripped out:
  • No Tensor9 BYOC Terraform provider
  • No Tensor9 BYOC runtime links or reflection resources
What remains is the vendor’s application infrastructure as the customer will see it in their account: the compute, storage, networking, and managed service resources that the deployment stack provisions.
The audit stack is intended for review only. Do not apply it. The deployment stack is what actually provisions a working appliance - the audit stack is a companion artifact for inspection.

​
How it’s produced

Audit stack compilation happens automatically as part of tensor9 stack release create. No extra flags or configuration are required. If audit stack compilation fails for any reason, the release itself is not blocked - the deployment stack is still produced. Audit stacks are currently produced for Terraform and OpenTofu origin stacks.

​
Where the audit stack lands

When tensor9 stack release create finishes, it writes the audit stack to disk alongside the deployment stack, under a directory named after the target appliance:
The deployment stack directory is what you (or your customer) feed to tofu init / tofu apply. The .audit directory mirrors it for inspection.

​
Review workflow

A typical pre-deployment review loop:
1

Create the release

Creating a release for an appliance also writes the compiled deployment and audit stacks to the local filesystem:
This produces both the deployment and audit directories for the customer’s appliance.
2

Inspect the audit stack

Point your existing IaC review tooling at the .audit directory. For example:
Because the audit stack has no Tensor9 BYOC providers or runtime plumbing, these tools can plan and scan it standalone and see exactly the resources your customer will be asked to host.
3

Hand off for customer review

Share the .audit directory with your customer’s security or platform team. They can run it through their own review pipeline - including tools like Atlantis or Spacelift - without any Tensor9 BYOC-specific context.
4

Apply the deployment stack

Once review is complete, apply the deployment stack (not the audit stack):