CONTINUOUS SECURITY EVIDENCE
Every incident produces a review-ready evidence bundle.
Ollandi records what was observed, what was inferred, which constraints were checked, who approved the action, what changed, and whether containment worked.
WHAT IT DOES
Evidence should be created while the event unfolds, not reconstructed after memory and context have disappeared.
01
One chronology, end to end.
Follow a situation from its first signal through every connected finding, policy check, operator decision, and verified outcome.
- Time-ordered events
- Source attribution
- Connected supporting context
01OBSERVESignal and source preserved
02CONNECTInfrastructure context attached
03DECIDEPolicy and authority recorded
04ACTBounded change captured
05VERIFYOutcome and residual state confirmed
02
Reasoning that can be inspected.
Ollandi shows the evidence used, the policy applied, the alternatives considered, and the uncertainty that remained.
- Evidence references
- Policy version
- Visible uncertainty
SUPPORTSThree connected observations
CHALLENGESOne unresolved dependency
POLICYBoundary version 4.2
03
A record built for many readers.
Operators need depth. Leaders need consequence. Reviewers need provenance. The same record supports each without changing the underlying truth.
- Operational detail
- Executive narrative
- Review-ready provenance
WHAT CHANGEDIdentity dependency affected customer service
AUTHORITYNamed operatorOUTCOMEService verifiedREMAININGOne review item