Skip to content

Free for nonprofits, NGOs, think tanks, and institutes. Grant funded by James Scott, administered by the Embassy Row Project.

ArtOfTheHack home

7 minute read

The Governed Decision Object

The signature artifact of evidence-governed cybersecurity: a complete, replayable record of what was known, what was concluded, and who authorized the action.

An artifact, not a log line

A ticket records that something happened. A governed decision object records why a specific action was the correct one at a specific moment, on the basis of specific evidence, under a specific authority.

What it contains

Each object is self-contained. It can be exported, examined by an auditor, replayed against a later state of the environment, and compared against the outcome that actually occurred.

  • Evidence set with source, timestamp, and reliability for each item
  • Reasoning path including the alternatives that were considered and rejected
  • Calibrated confidence and the conditions that would change it
  • Policy evaluation and the authority under which the action was permitted
  • Blast radius, reversibility, and the rollback path if one exists
  • Human approval record where the action required it

Why it is the prerequisite for automation

An organization cannot responsibly automate an action it cannot explain. Once the explanation is structured and machine-readable, the same object supports supervised recommendation, then bounded automation, then post-hoc assurance, without changing the underlying reasoning.