01Direction
Policy and governance
Policies, objectives, approvals and the decisions that set them.
Observation framework for regulated systems
If it has a standard, it can be observed.
Regulated systems answer to standards: ISO management systems, prudential standards, codes of practice and best-practice guides. selfdriven.observer turns a standard into criteria that octonomous systems watch every day. Human observers hold the judgement and the signature.
management systemsprudential standardsbest-practice guidescodes of practice
Load a standardexample decomposition · same fields for every standard
Profile
6
steps from a standard's requirement to an assurer's reading of the record
8
octonomous observers, one for each selfdriven Area of Focus
100%
of the population observed, where an audit tested a sample
1
human signature on every finding before it reaches the record
The framework
Every standard has the same shape.
Clauses, controls, paragraphs, strategies: the vocabulary changes and the structure stays. A standard states requirements. An organisation decides what meeting them looks like. Evidence shows whether it does. The framework makes each step observable and signs it.
- 01standard
Requirement
What the standard asks, referenced by its own identifier. The framework holds references, never the standard's text.
ISO/IEC 27001 A.8.13 - 02organisation
Criterion
What meeting the requirement looks like here, with a threshold, a population and a cadence.
restore tested ≤ 90 days · all volumes · daily - 03source system
Evidence
Where the truth already lives: the system, log or record that shows whether the criterion holds.
backup job history · restore records - 04octonomous
Observation
The criterion tested against the whole population and signed by the observer that ran it.
412 of 412 observed · ixn anchored - 05human
Finding
Conforming, opportunity for improvement or nonconformity. A human observer confirms the grade and signs.
OFI · confirmed with passkey - 06assurer
Assurance
The certification body, regulator or assessor reads the record for the period they assure.
surveillance window · scoped credential
What the framework is made of
Load a profile. Keep everything else.
Only the profile changes between standards. Scope, criteria, observers, connectors, the record and its views work the same way for every standard you load.
- Standard profile
The standard as structured data: identifiers, units of requirement, applicability rules and relationships to other standards. Licensed text stays with its publisher.
profile - Scope
The system being observed and which requirements apply to it, with the reason for each exclusion.
scope · applicability - Criteria
Your own tests for each requirement: what is measured, across which population, against what threshold, how often.
criterion - Observers
Eight octonomous observers, each delegated by a human conductor, plus the human observers who review their findings.
observer AID - Evidence connectors
Read-only links to the systems that already hold the evidence: cloud accounts, identity, ticketing, HR, finance, operations.
connector - Signed record
Every observation, finding and review as a verifiable credential, anchored in the signer's key event log.
ACDC · KEL - Views
The record cut for each reader: operators, management, the board, auditors and regulators.
view
Standards it fits
Built for standards of every kind.
If a standard states requirements and evidence can show they are met, it fits the framework. ISO/IEC 27001 is the first profile. The rest show the range of standards with the same shape.
Management system standards
Clauses plus controls. Assured by accredited certification bodies.
- ISO/IEC 27001use case 01
- ISO 9001Quality
- ISO/IEC 42001AI
- ISO 22301Continuity
- ISO/IEC 27701Privacy
- ISO 14001Environment
Regulatory and prudential
Numbered obligations. Supervised by a regulator, owned by the board.
- APRA CPS 234Info security
- APRA CPS 230Operational risk
- Privacy Act APPsPrivacy
Best-practice guides
Functions, strategies and maturity levels. Self-assessed or independently assessed.
- NIST CSF 2.0Cyber risk
- ASD Essential EightMitigation
- CIS ControlsSafeguards
Attestation and industry codes
Criteria tested over a period. Reported on by an independent firm or assessor.
- SOC 2Trust services
- PCI DSSCard data
Human tools & octonomous systems
Machines watch at volume. People decide.
Two kinds of observer work side by side under every standard. Octonomous systems read, test and report without pause. Human observers hold the conversations, the judgement and the signature, using tools built around the record.
Human tools
For the human observer, the system owner and the assurer who reads the record.
- Observation consoleEvery requirement's state today, or on any past date.
- Finding reviewConfirm, regrade or dismiss a finding, then sign with your passkey.
- Interview notesConversations and walkthroughs stay human. Notes are signed and linked to the requirements they cover.
- Review packsManagement review, board and regulator packs assembled from the record.
- Assurer accessGive an auditor, assessor or regulator a scoped, time-limited credential to read the record.
Octonomous systems
Eight observers organised on the selfdriven Areas of Focus, each conducted by a human.
- octonomous /ok-TON-uh-mus/
- Eight autonomous observers, one for each Area of Focus. Each holds its own KERI identifier, delegated by a human conductor, with authority scoped to reading and reporting.
- Delegated identity. Each observer's AID is created by a dip event from its conductor's AID. Authority traces to a person.
- Read-only scope. Observers never change the systems they watch. They report, and a human acts.
- Time-limited keys. Delegations expire, and pre-rotation lets a compromised observer be replaced without losing its history.
- Standard-agnostic. The same eight observers serve every profile. A new standard maps its requirements onto them.
The eight observers
Each observer watches one Area of Focus, whichever standard is loaded.
02Engagement
Suppliers and partners
Suppliers, cloud providers, customers and regulators.
03Enablement
Competence
Training, onboarding and the competence each role requires.
04Protocols
Identity and access
Identity, access, cryptography and data standards.
05Sustainability
Continuity
Continuity, capacity, backup and the resources behind them.
06Processes
Operations and change
Operations, change, configuration and service delivery.
07Accountability
Monitoring and audit
Logs, monitoring, incidents, internal audit and reporting.
08Organisational
Roles and structure
Roles, segregation of duties, joiners, movers and leavers.
What the human auditor used to do
From the visit to the record.
Assurance has run on visits: a few days on site, a sample tested, a report written, then a year of quiet. The framework keeps the same questions open every day and leaves the judgement with people.
The auditor tested 25 of 400 access reviews. Observers test all 400, every time one changes.
Assurance arrived once a year. Observation runs every day, and the assurer reads any period they choose.
Evidence was a file someone saved. Now each result is a credential anyone can verify.
Use cases
Starting with information security.
Use case 01
ISO/IEC 27001, with ISO/IEC 27017 for cloud services
The framework with the ISO/IEC 27001:2022 profile loaded. All 93 Annex A controls mapped to the eight observers, a three-year certification cycle observed every day, and a signed record ready for the certification body.
93 Annex A controlsclauses 4–1027017 cloud extension
Open the ISO/IEC 27001 use case
profile iso27001:2022 · example
- 05:01:54A.8.15LoggingConformingAudit logging on in 14 of 14 regions
- 05:01:41A.8.13Information backupOFI3 volumes last restored 97 days ago
- 05:01:00A.8.8Technical vulnerabilitiesMinor NC2 critical CVEs open past the 14-day target
The next profiles are chosen with the organisations that bring them. Bring a standard.
Assurance
Assurance stays with the assurer.
The framework doesn't certify, attest or supervise. Certification bodies, regulators and assessors keep that role. They get a continuous, signed record to work from in place of evidence gathered the week before.
Verify without trusting us
Observations are ACDC credentials chained to the requirement, the observer and the reviewer. An assurer checks the signatures against the key event logs, not against our word.
Authority traces to a person
Every observer AID is delegated from a human conductor's AID with a dip event. If an observer misbehaves, its conductor revokes it and the record shows when.
Assurers read, scoped and dated
Assurer access is a credential for a defined window. It opens the record for that period and expires on its own.