Open every required evidence item.
Begin with the record, movement, or permission. Read what proves the failure, not what merely suggests it.
Operational case simulator Static release
Understand the system, not only the visible symptom
When a system
fails quietly.
Enter an operational incident, inspect the evidence, then choose the control that addresses the failure mechanism. No accounts and no tracking: your results remain on this device.
Start the first caseCONTROL STATE / MISMATCHSYSTEM//EXPOSED
Inspect
GAP
GAP
01Evidence
02CONTROL
03IMPACT
Deterministic decision engineNo random outcomesEvidence-led cases
How an investigation starts03—01
Connect evidence to responsibility.
Ask who owns the action, where the rule lives, and which state should have prevented the error.
Choose the architectural control.
After reviewing the evidence, select one control. The report makes its effect and architecture explicit.
Case ready now
CASE_001 / The Unopened Door
Learn to distinguish between a suspicious access attempt and accusing a user before the evidence is complete.
Open case