Alert at assess exposure
Aaron Whitfield
Information Technology · Cybersecurity Operations · IT7C Major Incident
$33k
value
77%
confidence
20
people affected
5h 32m
age
3h 26m
sla
50%
progress
Currently held by
Threat Intelligence Agent
An agent owns the next move
Raised by
Zara Kowalski
Requester of record
At station
Assess exposure
Workflow layer · station 4 of 8
Where this train is on the line
Evidence trail
Every station this unit has passed, who acted, and what they left behind
This is the readable trail. The same actions are held in the append-only evidence spine with their authority grant, version stamps and hash links; open the auditor pack to see them.
Cleared declare
-332mDirector, Security Operations
Approval recorded with rationale and policy clause cited
Cleared contain
-249mThreat Intelligence Agent
Inputs, rule version and output hash written to the evidence log
Cleared human commander
-166mDirector, Security Operations
Approval recorded with rationale and policy clause cited
Holding at assess exposure
-83mForensics Support Agent
Inputs, rule version and output hash written to the evidence log
What happens next
The next station and its rule
Legal notify
run by Director, Security Operations · Policy layer
Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
Why the signal is what it is
Plain reading of the current state
Amber. The agent completed the work but the outcome fell into a sampling band, so it posted evidence for review rather than closing silently. Work carries on; a human confirms after the fact.
Past SLA by 2h 6m · 20 people or records downstream of this decision