Every Accepted Risk Now Has a Name, a Date and an Expiry — NSAuditor AI Enterprise 0.35.0
NSAuditor AI Enterprise 0.35.0 gives the suppression-approval workflow a command line — compliance suppress, review, renew and keygen — so every accepted risk carries an owner, a rationale, a date and an expiry, and review lists what is about to lapse before your assessor asks.
LAS VEGAS, NV — 12 August 2026. Nsasoft US LLC has released NSAuditor AI Enterprise Edition 0.35.0, paired with Community Edition 0.2.40 and agent-skill 0.2.38. It is the release that gives the suppression-approval workflow an entry point an operator can actually reach.
Your auditor doesn’t ask what you fixed
They ask what you accepted.
Every security team suppresses findings. A false positive, a compensating control already in place, a risk the business has consciously signed off on — the decision is legitimate and routine. What is rarely as tidy is the record of that decision: a comment on a ticket, a row in a spreadsheet, or an understanding that lived in one engineer’s head and left the company with them.
That gap is exactly where assessors spend their attention. A scanner’s clean result is only as good as the reason each finding stopped appearing in it.
Four commands
Enterprise 0.35.0 ships compliance suppress, compliance review, compliance renew and compliance keygen.
suppressrecords the decision with an owner, a rationale, a date and an expiry.reviewlists what is about to lapse.renewextends a decision, and states plainly what that does to the record.keygencreates the approval keypair, writes the private half0600, and prints an identity-registry entry ready to paste.
Every accepted risk now has a name, a date and an expiry.
The command practitioners will feel is review
A suppression with an expiry is a different object from a suppression without one. It resurfaces on your schedule — during a quarterly pass, when the compensating control is due for a look — rather than in someone else’s findings report three days before fieldwork opens.
The decision stops quietly disappearing and becomes an artifact an assessor can read: who accepted it, on what grounds, when, and until when.
A key that refuses to overwrite itself
keygen declines to overwrite an existing signing key. The reasoning is worth stating because the failure it prevents is invisible at the moment it happens: regenerating a signing key destroys the ability to verify every signature that key ever produced, and nothing reports it at the time. The identity registry still names the old fingerprint, so the damage only surfaces months later, on an archived approval that was perfectly correct when it was written.
A malformed key reference fails at the command and writes nothing at all. An operator who configured a signing key asked for a signed approval; handing them an unsigned one plus a warning is evidence weaker than their stated intent.
Ed25519 suppression signing is reachable and not yet proven — compliance suppress signs the approval it writes when NSAUDITOR_SIGNING_KEY names a local signing key, and its verification gate has not yet run against the published bytes of this release. The company publishes that distinction rather than rounding it up. The always-on evidence-integrity layer remains the SHA-256 chain of custody, which verifies offline.
What has not changed
The plugin catalog is unchanged at 28 Enterprise plugins — 27 cloud auditors across AWS, Azure and GCP, plus one Zero Trust posture assessment scored from a network-host scan, for 55 in total with Community Edition’s 27.
All seven compliance coverage matrices are unchanged: SOC 2 (AICPA TSC), HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8 and GDPR Article 32 infrastructure substrate. One command across all three clouds with all seven frameworks enabled evaluates 1,608 controls and returns seven auditor-shaped reports from a single scan.
RFC 3161 trusted timestamping remains opt-in via NSAUDITOR_TSA_URL, pointed at a Time-Stamp Authority the customer chooses, with no default ever.
Availability
All three packages are live on npm:
npm install -g nsauditor-ai@latest @nsasoft/nsauditor-ai-ee@latest nsauditor-ai-agent-skill@latestEnterprise 0.35.0 requires Community Edition 0.2.40 or newer. The approval commands live in the Community Edition and forward to Enterprise, so an older Community install cannot reach them. Community Edition is free and MIT-licensed; the Enterprise package is private and licensed per seat.
Everything runs on the operator’s own machine — agentless, read-only, with scan data written to the customer’s own directory.
Product page: https://www.nsauditor.com/ai/enterprise/
