Audiences
Operator reference: Role-based reading paths for operators, approvers, defenders, and integration authors.
Operator reference. This page describes the governed-workflow model, not app permissions or a guarantee of deployed enforcement. Use Get started for the app and Account and CLI help for Owner/Viewer access. Apply a control claim only to its named implementation and evidence.
This section helps each reader start in the right place so they can act safely without reading the entire docs set first.
App readers
Start with Your first observation as an Owner, or Understand results and reports as a Viewer. The responsibilities below describe human review and operator workflows; they do not confer app access.
1. Problem this page solves
Readers lose time and make bad assumptions when role-specific starting points are unclear.
This page defines role-based starts, decision boundaries, and what each role should ignore at first.
2. What you should understand after reading
After this page, you should understand:
- which reading path matches your role
- what each role needs first
- which decisions each role owns or supports
- where to start and what to defer at the beginning
3. Mechanism-first audience routing model
| Role | Owns or leads | Start here first | Defer initially |
|---|---|---|---|
| New Operator | in-scope execution decisions, evidence capture, escalation triggers | scope -> operations -> evidence and decisions | deep integration and reference tails |
| Defender | triage validation, containment and evidence preservation, incident escalation | evidence -> operations -> governance and decisions | implementation and integration authoring detail |
| Manager / Approver | authorization boundaries, proportionality, approval and review standards | governance -> authorization -> evidence -> decisions | low-level tool execution detail |
| Integration Author | integration boundaries, runbook interfaces, evidence contract behavior | integrations -> runbooks -> receipt spec and governance | scenario education paths |
4. Observed vs inferred
| Layer | What is observed | What is inferred |
|---|---|---|
| Observed | role pages define starting order, responsibilities, and handoffs | none beyond documented role contracts |
| Inferred | role effectiveness in practice | depends on reader discipline and adherence to role boundaries |
5. Role-specific trust assumptions
All roles share the same core trust limits, such as upstream input quality, runtime and tool integrity, and bounded evidence interpretation, but each role tends to fail in a different way:
- operators: scope and action proportionality errors
- defenders: triage overconfidence under uncertainty
- approvers: authority overreach or rubber-stamp risk
- integrators: undocumented behavior and weak interface contracts
6. Next-page handoff
Next, read New Operator as the first role entry path in this section.