GCP Professional Cloud Security Engineer (PCSE) → Genie mapping

Audience: the security reviewer who knows the GCP PCSE blueprint and wants to know how a non-GCP, on-prem-first, RBI FREE-AI-aligned agentic platform addresses the same concerns. Source: the official Google PCSE exam guide, sections 1–5 with weighted percentages 25/22/23/19/11.

The point of this document is not to claim Genie is “GCP PCSE compliant.” That’s a category error — Genie isn’t a GCP product. The point is to demonstrate, bullet by bullet, that Genie addresses the same security concerns the PCSE blueprint codifies, using application-layer primitives instead of Google Cloud products wherever the concern is portable.

Status legend:

• ✅ implemented (file path + test name cited)
• 🟡 partial (what’s done, what isn’t)
• ⚪ not implemented (with honest reason — by design, roadmap, or N/A)

If a row claims ✅ without a file/test anchor, treat it as a doc bug and open an issue.

Table of contents

• How to read this map
• Section 1 — Configuring access (25%)
• Section 2 — Securing communications and boundary protection (22%)
• Section 3 — Ensuring data protection (23%)
• Section 4 — Managing operations (19%)
• Section 5 — Supporting compliance requirements (11%)
• Honest gaps and roadmap
• Appendix: PCSE → FREE-AI cross-walk

How to read this map

For each PCSE bullet:

1. Bullet quoted verbatim from the exam guide.
2. Genie analog — the closest application-layer equivalent, or “out of scope: deployment platform” when the concern is GCP-infrastructure- specific.
3. File path / test — exactly where in the repo.
4. Why this differs — when the analog isn’t a one-to-one (e.g., we ship application-layer perimeter where GCP ships network-layer perimeter).

The deployment-platform concerns — VPC, NGFW, Cloud Armor, IAP, Interconnect — are intentionally out of scope. Genie runs on whatever Kubernetes / VM / on-prem fabric the bank deploys it on; the perimeter at that layer is the platform’s responsibility, not the application’s.

Section 1 — Configuring access (25%)

1.1 Managing Cloud Identity

Anchors: pkg/auth/types.go · pkg/auth/jwt.go · pkg/auth/oauth2/ · pkg/auth/oauth_device/ · pkg/auth/webauthn/ · pkg/web/handlers/users.go

1.2 Managing service accounts

Anchors: pkg/identity/identity.go · pkg/auth/tokenexchange/exchange.go · pkg/auth/jwt.go::Issuer.TTL · docs/packages/oauth-token-exchange.md

1.3 Managing authentication

Anchors: pkg/auth/password.go · pkg/auth/oauth2/ · pkg/auth/oauth_device/ · pkg/auth/webauthn/

1.4 Managing and implementing authorization controls

Anchors: pkg/web/mid/auth.go · pkg/governance/rbac.go · pkg/governance/policy.go · pkg/policy/dsl/ · pkg/governance/tenant.go · pkg/storage/postgres/migrations/0005_rls.sql · pkg/sovereignty/sovereignty.go

1.5 Defining the resource hierarchy

Anchors: config/ai-policy.example.yaml · pkg/policy/dsl/ · docs/packages/policy-dsl.md

Section 2 — Securing communications and boundary protection (22%)

The vast majority of this section is GCP-infrastructure-specific (Cloud NGFW, IAP, Cloud Armor, VPC peering, HA VPN, Interconnect, Private Service Connect). The Genie analog is application-layer perimeter and classification-based segmentation. Out-of-scope items are listed for completeness.

2.1 Designing and configuring perimeter security

Anchors: pkg/governance/prompt_injection.go · pkg/governance/pii.go · pkg/governance/classification.go · pkg/governance/schema_policy.go · pkg/governance/policy.go::CompositePolicy · pkg/web/mid/ratelimit.go · pkg/web/mid/tracing.go

2.2 Configuring boundary segmentation

Anchors: pkg/sovereignty/sovereignty.go · pkg/llm/router.go (the LLM router consults the registry before dispatching) · docs/linkedin-article-sovereign-ai.md

2.3 Establishing private connectivity

Every bullet in this sub-section is GCP-infrastructure-specific (Shared VPC, VPC peering, HA VPN, Cloud Interconnect, Private Google Access, Private Service Connect, Cloud NAT). Out of scope — deployment platform.

For an on-prem deployment, the analog is the bank’s existing network-segmentation policy plus Genie’s pkg/sovereignty provider allowlist — which collectively answer the same question (“can this data class reach this destination?”) at the application layer.

Section 3 — Ensuring data protection (23%)

This is Genie’s home turf. Every sub-section maps cleanly.

3.1 Protecting sensitive data and preventing data loss

Anchors: pkg/governance/pii.go · pkg/incidents/incidents.go · pkg/storage/postgres/tenant.go · pkg/storage/postgres/migrations/0005_rls.sql · pkg/crypto/envelope.go · pkg/crypto/resolver.go · docs/packages/postgres-rls.md · docs/packages/governance-tenant.md

3.2 Managing encryption at rest, in transit, and in use

Anchors: pkg/crypto/envelope.go · pkg/crypto/resolver.go · pkg/storage/postgres/retention.go · docs/ai-governance-security.md §10 · docs/operations.md (KEK rotation runbook)

3.3 Securing AI workloads — the bullet Genie was built for

Anchors: docs/ai-governance-security.md (entire document) · pkg/governance/prompt_injection.go · pkg/safety/ (plugin chain + bias) · pkg/governance/classification.go · pkg/sovereignty/sovereignty.go · pkg/llm/router.go · pkg/llm/budget.go · pkg/llm/circuit.go · pkg/llm/deadline.go · pkg/auth/tokenexchange/ · pkg/storage/postgres/migrations/0005_rls.sql · pkg/compliance/audit.go · pkg/agent/tier.go · cmd/red-team/ · cmd/bcp/

Section 4 — Managing operations (19%)

4.1 Automating infrastructure and application security

Anchors: cmd/red-team/ · pkg/agent/tier.go · tests/security_envelope_test.go · docs/ai-governance-security.md Appendix C · docs/operations.md (tier promotion checklist) · docs/packages/agent-tier.md

4.2 Configuring logging, monitoring, and detection

Anchors: pkg/observability/ · pkg/observability/bq/ · pkg/compliance/audit.go · pkg/incidents/ · pkg/web/handlers/inventory.go · pkg/web/handlers/incidents.go · pkg/web/handlers/aibom.go · pkg/web/handlers/ui_security_test.go · docs/ai-governance-security.md §11, §12, §16

Section 5 — Supporting compliance requirements (11%)

5.1 Adhering to regulatory and industry standards

Anchors: docs/operations.md · docs/ai-governance-security.md §19.2 · pkg/sovereignty/sovereignty.go · config/ai-policy.example.yaml · docs/free-ai-mapping.md

Honest gaps and roadmap

Gaps where a PCSE-aligned reviewer would expect more than Genie currently ships. In priority order:

Gap 1 — Privileged Access Manager analog (PCSE 1.4) — ✅ CLOSED

Shipped as pkg/auth/elevation (430 LoC + 430 LoC of tests). See packages/auth-elevation.md for the full spec. Highlights: request/approve/deny/revoke lifecycle, N-eyes via RequireApprovers, lazy expiry (no daemon), every transition in the hash-chained audit log with audit_root for per-grant trace-back, HTTP surface at /v1/elevation/* with router + service double-gate.

Total HTTP surface added: 6 routes. Total tests added: 33 (22 service unit + 11 HTTP contract).

Gap 2 — Format-preserving encryption (PCSE 3.1)

What’s missing. Encrypted Aadhaar that’s still 12 digits, encrypted account number that still passes Luhn — for cases where downstream schemas can’t accept ciphertext.

Proposed shape.

// pkg/crypto/fpe/fpe.go (proposed)
type Mode int
const (
    ModeDigits Mode = iota   // preserve digit length
    ModeAlpha                 // preserve length within [A-Z0-9]
)
type Cipher struct { Key []byte; Mode Mode }
func (c *Cipher) Encrypt(plaintext string) (string, error)
func (c *Cipher) Decrypt(ciphertext string) (string, error)

Implementation: FF3-1 (NIST SP 800-38G) over AES. LoC estimate: ~400 with the FF3-1 algorithm + a NIST test vector check.

Gap 3 — SAML verifier (PCSE 1.3)

What’s missing. Many banks have a SAML 2.0 IdP they want Genie to federate against (Okta, ADFS, internal). Today Genie consumes OAuth and its own JWT; SAML is the missing third format.

Proposed shape. New pkg/auth/saml/ with assertion parsing, XML signature verification, and an HTTP middleware that exchanges a SAML assertion for a Genie JWT. LoC estimate: ~600 (XML sig is the bulk).

Gap 4 — KEK rewrap background job (PCSE 3.2)

What’s missing. After a KEK rotation, older rows still point at the old kek_id. Today the resolver handles this by keeping the old KEK reachable; the lazy rewrap job that re-wraps older DEKs with the new KEK is roadmap.

Proposed shape. A periodic job in pkg/storage/postgres/rewrap.go that scans for rows with kek_id != active_kek_id, decrypts the DEK, re-wraps under the active KEK, updates the row, writes one audit entry per rewrapped row. LoC estimate: ~150 + test that exercises a full rotate-and-rewrap cycle.

Lower-priority gaps

• Workload Identity Federation full wiring (PCSE 1.2). DID/VC primitives ship; SPIRE server + mTLS at the proxy is what’s missing. Mostly a deployment artefact, not Go code — adds an Envoy proxy with SPIRE-issued SVIDs in the cluster.
• Group abstraction over roles (PCSE 1.4). A groups table + a group → roles join. Useful in multi-bank deployments where the same user model is shared across orgs. ~200 LoC.
• Custom organisation modules for Security Health Analytics (PCSE 4.1). GCP-specific tooling; the application analog is the existing envelope-tests, but a “live posture dashboard” that scores the policy stack would be a nice add. ~300 LoC + UI.

Appendix: PCSE → FREE-AI cross-walk

The PCSE blueprint and the RBI FREE-AI report concern themselves with the same security substance, expressed in different vocabularies. The table below cross-references the headline overlaps. The full FREE-AI map is at free-ai-mapping.md.

A reviewer who knows PCSE can read this map → FREE-AI → file path; a reviewer who knows FREE-AI can read the FREE-AI map → file path → this map for the PCSE counterpart. The two indexes are mutually reinforcing.

See also

• ai-governance-security.md — the canonical Genie security reference; every PCSE row above has a deeper section there.
• free-ai-mapping.md — RBI FREE-AI 26 recommendations → file path map.
• operations.md — runbook including the KEK rotation, the tier promotion checklist, and the security-envelope verification command.
• packages/postgres-rls.md, packages/governance-tenant.md, packages/oauth-token-exchange.md, packages/agent-tier.md — the four Q1 security primitives’ per-package detail.