Find a solution
What is in front of you?
Start from the problem or the lifecycle event, not the paperwork. Each event lands on library pages that resolve it; every count on this page is generated at build time.
Events, 5
Common problems and events
One row per event, curated in the site generator. A row opens the leadership page that walks the event end to end or the leadership concern that owns it; where an event has more pages behind it, the row's Go deeper links name them, and every link target and count is checked against the library's registries at build time.
- From policy intent to independent assurance: the journey of a privileged-access controljourneyAdmin accounts, service accounts, and the people who can change everything. 8 governing documents. Go deeper: Can we show, with evidence, that our controls operate?; Security.
- Could we take the hit and keep operating?Detection, coordination, communication, and recovery. 4 leadership pages, 30 governing documents. Go deeper: Resilience; Security; Operations.
- From AI idea to retirement: the governed life of an AI systemjourneyIntake, approval, oversight, incidents, and retirement, governed like any other system. 18 governing documents. Go deeper: What is AI doing on our behalf, and who approved it?.
- How exposed are we through the parties we depend on?Onboarding, ongoing monitoring, concentration, and exit. 3 leadership pages, 26 governing documents.
- From retention rule to destruction evidence: the governed journey of a recordjourneyClassification, retention, cross-border movement, and provable destruction. 8 governing documents. Go deeper: Do we control our information from creation to destruction?.
Scenarios, 9
Rehearse a bad day
Every scenario in the library's executive layer, generated from the narrative registry, so a newly published scenario appears here without an edit. The same pages are indexed under Scenarios on the executive path.
- What happens when a critical AI supplier failsAI, Privacy, Resilience, Risk, Security, Supply chain
- What happens when a monitored risk breaches the appetite the governing body setGovernance, Risk
- When a crypto-asset custody key is compromised and client assets are moved on-chainCrypto
- When a customer-data service must move after its legal operating boundary changesArchitecture, Compliance, Operations, Privacy, Risk, Supply chain
- When a release-signing key is compromised after software reaches productionDev security, Operations, Security
- When an AI agent acts beyond its granted authorityAI, Governance, Resilience, Security
- When an AI-suggested dependency turns out to be a malicious packageDev security
- When an unauthorized production change takes a critical service downOperations
- When the enterprise identity provider can no longer be trustedOperations, Resilience, Risk, Security
Builders
For the CIO and the architect
Building or changing systems rather than responding to one event? These domains carry the technology side of the corpus.
- Architecture8Reference architectures and secure-design control patterns
- Dev security18Secure development lifecycle, CI/CD, and pipeline controls
- Operations27Operational security, monitoring, and IT service management