Rather than explain the six lenses in the abstract, we follow one connected thread — a single device and the apps, keys and vendor attached to it — through all six. Each lens does something concrete and different, and a single composite governance posture score climbs as the record fills in. The principles appear as tags, not paragraphs.
Connect Intune, Azure AD, OpenAudit and the GL. Fifteen-plus feeds that disagree collapse into 1,760 assets, 0 conflicts. One device — WS-4471, a Design-team MacBook — surfaces as past end-of-life with 3 unused Adobe seats; the nightly SAM run quantifies $116,950 of licence risk across the estate.
On the record now 1,760 governed assets · WS-4471 flagged EOL · 3 Adobe seats idle · $116,950 licence risk quantified.
The same Design team runs a creative agent on an OpenAI key nobody registered. AssetZentri pulls that key onto the same record as WS-4471 — and finds a second, ungoverned key in another team.
Added to the record 2 LLM keys governed · 1 shadow key revoked · spend capped per agent · calls on the append-only ledger.
Five-channel discovery surfaces 598 SaaS apps and a 2,306-deep pending queue. Two of them are the same design tool, bought twice by two departments; 40% of Zoom seats sit idle; one contract auto-renews next week.
Added to the record 598 SaaS mapped · duplicate consolidated · 15–25% recoverable booked · spend GL-allocated.
The Design-team user behind WS-4471 still holds an admin grant from a project that ended — and a combination that breaks segregation of duties. Then they resign in Workday.
Added to the record stale admin removed · 0 SoD violations · leaver fully deprovisioned in minutes.
Nothing new is collected. WS-4471's encryption state, the access-review certification from Lens 04 and the licence true-up are already on the record — so they simply map to the frameworks.
Added to the record 6 frameworks green · evidence cross-mapped · control drift 0.
The software flagged on WS-4471 comes from a vendor whose terms claim ownership of uploaded data. The breach feed then reports that same vendor was just compromised.
Added to the record vendor scored & flagged · breach surfaced · renewal leverage created.
The same record that proves your licence position also prices it. From WS-4471’s idle Adobe seats outward, AssetZentri totals what you spend, what is wasted, and what renews next — so finance acts before the auto-renewal, not after.
On the recordevery figure ties to the asset and identity it belongs to — so a reclaim updates the SaaS & Spend posture, books the saving to the GL, and Renewal Briefs make sure no contract auto-renews unreviewed.
Figures are illustrative reference-tenant values — connect your billing, GL and contracts to populate real numbers.
Lens 05 didn't gather new evidence; it reused what the other lenses already produced. Here is that mapping made concrete — single items from our thread, each satisfying several frameworks at once. This is precisely why the posture jumped +13 at compliance with no new fieldwork.
| Evidence already on the record | SOC 2 | ISO 27001:2022 | SEBI CSCRF | DPDP / RBI |
|---|---|---|---|---|
| Disk encryption on WS-4471from the agent · Lens 01 | CC6.1information protection | A.8.24use of cryptography | Data-protection standard | Reasonable security safeguards |
| Access-review certificationfrom Identity · Lens 04 | CC6.2 · CC6.3access provisioning & review | A.5.15 · A.5.18access control & rights | Identity & access management | Access-limitation safeguard |
| HMAC-signed audit loggovern by construction | CC7.2 · CC8.1monitoring & change | A.8.15 · A.8.16logging & monitoring | SOC / audit logging | Breach evidence & accountability |
| Vendor T&C score + breach feedfrom Vendor · Lens 06 | CC9.2third-party risk | A.5.19–A.5.22supplier relationships | Supply-chain risk · SBOM | Data-processor obligations |
| AI token ledgerfrom AI & LLM · Lens 02 | CC7.2monitoring | A.8.16 + ISO 42001 | Technology-risk governance | Purpose & accountability |
One certification. Five frameworks. Zero re-collection.
Mappings are illustrative. SOC 2 (TSC) and ISO 27001:2022 Annex A references are indicative; SEBI CSCRF, RBI and DPDP are shown by control area. Validate exact clause mapping with your auditor before relying on it.
Change one thing: the tenant is now a SEBI-regulated fintech in Mumbai. Nothing about the record changes — what changes is which mandates it must answer, and where the data is allowed to live. A Western baseline answers SOC 2; it does not answer SEBI, RBI, IRDAI or DPDP.
The creative agent (Lens 02) and the T&C scanner (Lens 06) run on the per-tenant self-hosted LLM — customer data and contracts are analysed in-boundary. "Trust us, it's in Virginia" is not an audit answer in Mumbai.
WS-4471's location and each SaaS and vendor's residency feed a data-residency risk score — exactly what DPDP's safeguards and cross-border rules turn on.
SEBI CSCRF mandates SBOM and supply-chain risk. Software Intelligence (Lens 01) ingests SBOM/CVE/EOL and the breach feed (Lens 06) watches the supply chain — already on the record.
Shared SaaS-spend benchmarks are k-anonymous (k≥10), so a regulated fintech's posture is never re-identifiable in any aggregate.
Same record, four more frameworks. The Compliance dimension now carries SEBI CSCRF · RBI · IRDAI · DPDP beside SOC 2 and ISO — and, because of the mapping above, on the same evidence set you already collected.
AssetZentri supports the security, audit, asset-lifecycle and vendor-risk obligations of these regimes; it is not itself a DPDP Consent Manager. Regulatory dates are current as of mid-2026 — a 2026 MeitY consultation has proposed accelerating the DPDP deadline; reverify before publishing.
Read the score column back down the page: 38 → 51 → 63 → 76 → 89 → 94 → 97. Each lens added a concrete, different thing to the same record, and the posture was never re-built — only accumulated. That is the difference between visibility, a dashboard per silo, and governance: one record, read every way, scored continuously, that acts on what it finds and proves it did.