Read the context.
Know what the system was protecting and which boundary was crossed before looking for a person to blame.
CONTROL//FORGE / How the platform works
Investigate
before you decide.
Start with case context, inspect evidence, separate facts from assumptions, then select a control that addresses the root cause. Evaluation is deterministic: there is no hidden ranking or random answer.
Connect the evidence.
Open the record, role, and flow. Do not treat a claim as fact unless an auditable trace supports it.
Address the root.
Select a control that prevents recurrence, not one that hides the symptom. In chains, this determines what you can open next.