LensReading which lens this session carries.
IT7C-1026In flightmedium materiality

Alert at contain

Yuki Duarte

Information Technology · Cybersecurity Operations · IT7C Major Incident

$89k

value

88%

confidence

6

people affected

45m

age

2h 8m

sla

25%

progress

Currently held by

Containment Agent

An agent owns the next move

Raised by

Beatriz Rhodes

Requester of record

At station

Contain

Workflow layer · station 2 of 8

Where this train is on the line

IT7CMajor IncidentTransactional · 8 stations

Declare

7 q

Contain

1 live

Human commander

4 q

Assess exposure

39 q

Legal notify

8 q

Restore

14 q

Post-mortem

22 q

Board report

0 q

Evidence trail

Every station this unit has passed, who acted, and what they left behind

This is the readable trail.

  1. Cleared declare

    -45m

    Director, Security Operations

    Approval recorded with rationale and policy clause cited

  2. Holding at contain

    -23m

    Threat Intelligence Agent

    Inputs, rule version and output hash written to the evidence log

What happens next

The next station and its rule

Human commander

run by Director, Security Operations · Policy layer

Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.

approver Director, Security Operations

Why the signal is what it is

Derived from time against commitment, not from the state

Green. This item is still inside the time it was committed to, and it is not close enough to that line for its materiality to pull it forward. Green says nothing about who holds it: an item can be green and sitting with a person.

clock 45m against a commitment of 2h 8m · 35% of the time used
materiality medium · blast radius 6 records or people downstream
state in-flight — held separately, and deliberately not part of this reading