Scope the question.
Agree one system, review workflow, data boundary and acceptance criteria.
SCOPED PILOT / PROPOSED PROCESS
One system.
One change class.
A review you can evaluate.
A proposed evaluation of one system and one change class. Begin with synthetic examples, agree the evidence and measure whether the result helps a reviewer.
Request a scoped pilot by email Download one-page pilot brief ↓Start with security-group changes.
Agree one system, its mission, mapped controls and accountable owners. Prepare read-only AWS Config exports or synthetic equivalents, plus dependency mappings and baseline/current evidence.
The public workspace accepts fictional data only. Any operational export requires a separately agreed processing environment and security review. The product has no live AWS collector.
IAM trust-policy analysis is a possible separately scoped extension. The existing identity example demonstrates federation trust metadata; it is not a verified IAM-policy analyzer.
PROPOSED SUCCESS TARGET
Trace the case in under 15 minutes.
After an agreed case is loaded, can a reviewer identify the change, connected mission, relevant control, owner and supporting provenance in under 15 minutes?
This is a target to test—not an achieved customer result, SLA, setup time or guarantee.
Also test whether the reviewer can identify a deliberately incorrect mapping, recognize missing ownership, and distinguish missing evidence from an absence of risk. The workspace includes stale, disputed and undocumented dependency exercises.
A proposed 90-day outline.
Prepare the evidence.
Validate permitted inputs, dependencies, owners and control references.
Run and challenge.
Record review time, missing evidence, incorrect paths and reviewer corrections.
Refine and repeat.
Repeat agreed cases with corrected mappings and compare results.
Decide what follows.
Document results, security work, operational responsibilities and procurement options.
Timing depends on scope and security acceptance. Prices, support terms, deployment commitments and procurement routes must be agreed in writing.