Steward

02Deterministic workflow

1. 1 Scanning is scoped and approved, never exploratory Named shares, repositories, database exports and records systems. Nothing is discovered by crawling everything the service account happens to be able to reach.
2. 2 Classification is suggested; the owner decides Located material is matched by the same detector stack plus contextual classification, and mapped to your configured taxonomy. The data owner applies the label — the system proposes.
3. 3 Entitlement analysis is graph work, not inference AD and application entitlements are joined by deterministic graph analysis to surface dormant and orphaned accounts, excessive privilege, toxic combinations, service-account misuse and anomalous group changes. Those are computed facts.
4. 4 The model explains and ranks what the graph found It does not originate a risk assertion about a person. It makes a list of two hundred candidate findings small enough that a reviewer acts on the right one first.
5. 5 ACL snapshots are preserved at ingestion Retrieval is trimmed against them, so a reviewer sees the case they are assigned and nothing adjacent to it. Revocation propagates on a measured SLO through chunks, embeddings, caches and derived results.
6. 6 Insider-risk output is evidence plus hypothesis, always Never a determination, and never an input to an employment decision. A hypothesis a human can disprove is useful; a score that looks like a verdict is dangerous.
7. 7 Legal prerequisites are checked at onboarding Employee notice, purpose limitation, proportionality and jurisdiction-specific review are deployment prerequisites. The disclosure template pack ships as a product deliverable for your HR and legal teams to adapt.