🪲

intake evidence → classify the box → apply policy rules → produce readiness / scan / agent posture → flag exceptions → generate a report.

WTF is in this box?

What is this?
Do we know enough?
Who owns it?
Where does it live?
Can we scan it?
Can we install an agent?
What is the risk?
What exception is needed?
What should happen next?