Alert at legal notify
Naomi Sandoval
Information Technology · Cybersecurity Operations · IT7C Major Incident
$61k
value
78%
confidence
24
people affected
7h 51m
age
7h 56m
sla
63%
progress
Currently held by
Security Policy Agent
An agent owns the next move
Raised by
Clara Muller
Requester of record
At station
Legal notify
Policy layer · station 5 of 8
Where this train is on the line
Evidence trail
Every station this unit has passed, who acted, and what they left behind
This is the readable trail. The same actions are held in the append-only evidence spine with their authority grant, version stamps and hash links; open the auditor pack to see them.
Cleared declare
-471mDirector, Security Operations
Approval recorded with rationale and policy clause cited
Cleared contain
-377mThreat Intelligence Agent
Inputs, rule version and output hash written to the evidence log
Cleared human commander
-283mDirector, Security Operations
Approval recorded with rationale and policy clause cited
Cleared assess exposure
-188mForensics Support Agent
Inputs, rule version and output hash written to the evidence log
Holding at legal notify
-94mDirector, Security Operations
Inputs, rule version and output hash written to the evidence log
What happens next
The next station and its rule
Restore
run by Vulnerability Agent · Workflow layer
No gate here. The agent clears this station inside its envelope and posts evidence.
Why the signal is what it is
Plain reading of the current state
Amber. The agent completed the work but the outcome fell into a sampling band, so it posted evidence for review rather than closing silently. Work carries on; a human confirms after the fact.