CREED · Cyber Readiness Evidence Evaluation and Decision
Authorization should be
CREED ingests the binder a system owner submits, turns it into typed, content-addressed claims, evaluates it against the requirement set your office composed, and records every decision as a replayable event.
Same bytes, same result — on the server and on the submitter's laptop.
Introducing CREED, the oversight system for authorization binders.
Evidence in, claims out. One binder, one causal model. Every pass with a witness, every failure with a violation.
Why is AC-2 unmet on system ALPHA? @portfolio @drift
3 unmet · 1 waiver-dependent · drift since decision: 41 claims changed.
Reviewers start from the result, not from the binder.
The work around the reading, removed.
Six things the server does the moment a binder lands.
Deterministic extraction
Every file read by its bytes, never its declared type. Seven extractors, closed claim vocabulary.
Same bytes, same claims
One causal model
Root, artifact, claim, and coverage events. Content-derived identifiers.
Ingestion digest
Evaluation with witnesses
Whole-match witness per pass, violation per failure, waiver overlay kept separate.
Evaluation artifact
Drift, scoped
Against the last decision and the prior submission. Changed claims named; untouched claims listed.
Review the delta
Waivers with limits
Delegated expiry and excluded classes enforced by the server, not by convention.
Expiry on the portfolio
Audit without reconstruction
Ingestion, evaluation, drift, notices, rosters — every digest retained.
Replayable
One requirement per control, however many frameworks demand it.
Merged at resolution. Credited once. Assessed once.
A resubmission is evaluated the moment it lands.
Submitted binder 14 for ALPHA — what's unmet?
AC-2 (1) — no covering claim.
Found: 2 references, 0 implementations.
Satisfy with: control_implementation naming AC-2 with a statement reference.
Digests: ing 9f3a… · eval 71c0…
Returns state the requirement, what was found, what would satisfy it, and the digests to reproduce it.
Own your authorization.
One binary. A directory tree. No database. No outbound calls. Replay from records and journals on every read.
Same bytes, same result. Hold us to it.