The KryptonGRC Playground

Test a policy. Watch it pass or fail.

A free page where you test a cloud rule and see, in plain words, whether it passes or fails. No account. No sales call. A real policy engine works out the verdict while you watch. Nothing here is staged.

Free · No account and no sales call · A real policy engine gives the verdict

The configuration is the claim. The policy is the test. The output is the evidence. That is the discipline Krypton GRC runs on. Pick a lesson below and feel how it works on a small, honest example.

Open the full Krypton Audit Console

Policy as Code, Live

The Playground

—

of rules passed
in your runs

No runs yet this visit. The ring fills as your tests pass.

4

Lessons

0

Rules checked

0

Violations found

0

Fixes applied

Everything on this board counts this visit only. Leave the page and it resets, like a real workshop.

Four short lessons. Each one starts broken on purpose. Pick a lesson, press run and watch it fail. Then apply the fix, by hand or with one click, and run it again to watch it pass. You cannot break anything here.

The tester sleeps when idle. The first run can take up to a minute to wake it.

See the code

Two short files run every test. The setup states what exists. The rule states what should be true. Both are editable. The engine judges whatever you hand it.

The setup: what exists (JSON)

The facts, written as a list. This is the claim being tested.

The rule: what should be true (Rego)

The test, written so a computer checks it the same way every single time.

No runs yet. Your first verdict lands here the moment a test finishes.

How this page works

1. Pick a lesson

Each lesson pairs a cloud configuration with the policy written to judge it. The configuration claims. The policy cross-examines.

2. Run it, then fix it

The engine evaluates the exact files and reports every violation it finds. Apply the fix and run it again. The dashboard keeps score as you go.

3. Read the verdict

Passed means the policy found nothing to deny. Failed means it did, with the reasons printed. Either way the output is the evidence.

The policies on this page are generic, published and yours to keep. They teach the pattern. Testing systems you actually own, its configurations, its evidence and its agents, is the work the full product does behind sign-in.

Two doors from here

Your own systems, tested for real

The Playground judges sample files. The workspace judges yours: assessments across 27 frameworks, cloud evidence collected and sealed, agents tested before they act. Express is free. Your first full scan is free.

For: Teams ready to judge their own systems, not samples.

Enter the Krypton GRC workspace

Learn the judgement behind the policy

A policy is only half the craft. The other half is the call an auditor makes on evidence. The Practice Lab trains that call: a scenario, the evidence, your judgement, then the auditor's conclusion, with a note on where yours diverged.

For: Anyone learning the auditor's call before a real examination.

Visit the Practice Lab

Prefer to talk it through first? Book a free consultation, thirty minutes with me, not a sales rep.

Why I give this away

I am Terry Afram-Kumi. I audit for a living and I built Krypton GRC so a verdict never depends on who is asking. The Playground is the front porch: small, free and honest about what it proves. If it teaches you the pattern, it has done its job, and if you want the pattern run across all your systems, you know where the door is. Teaching with it? Run it in your classes and your videos. That is what it is for.

Built by Terry Afram-Kumi · CISA · PMP · MSc, Founder, Terafram