Research pillar · Zero Security Theatre

GRC engineering

Governance, risk, and compliance teams write policies, maintain spreadsheets, collect screenshots, and answer questionnaires. This pillar asks how much of that evidence the systems themselves can produce.

The question

Which parts of governance can be converted from document production into continuous evidence?

Active · since 2026 · Zero Security Theatre

The conversion

hypothesis

Much of the work in GRC turns system data into reports on a schedule. Machines can do more of that without weakening oversight.

People still have to decide which risks to accept, which exceptions are reasonable, what the evidence means, and when to stop an activity. Report preparation often leaves too little time for those decisions.

Each check leaves a dated result that a person can review.

Where the engineering sits

recommendation

Software engineering already has useful ways to handle each layer. Security and compliance teams can use them too.

Governance artifact	Engineering equivalent	What it produces
Written policy	Machine-readable policy with an enforced rule	A statement that can be tested, versioned, and diffed
Control narrative	Controls as code with an executable test	A pass, fail, or unknown result on a schedule
Evidence screenshot	Evidence pipeline with query provenance	An artifact an auditor can reproduce
Annual control review	Continuous test with drift alerting	Time between drift and detection as a metric
Risk register	Linked findings with measured blast radius	Prioritisation based on reach rather than severity labels
Audit preparation	Standing evidence store	An audit that reads rather than assembles

Related work at the firm

observation

This pillar connects to existing research on AI-native software, observability, and evidence-bearing operations. Work on Operational Truth supplies the state distinctions used throughout, and work on unbundling knowledge work supplies the method for deciding which governance tasks should be human, machine, shared, redesigned, or removed.

These links provide research context. They do not claim that a product solves the problem.

What would prove us wrong?

unknown

The pillar assumes automated evidence production improves governance rather than merely accelerating it.

Evidence that automated evidence volume reduces the attention paid to each item, producing worse decisions than a smaller manual set.
Auditor behaviour showing that machine-collected evidence is discounted or re-requested in human form, adding cost rather than removing it.
Cases where the effort to encode controls exceeded the recurring effort it replaced, for environments below a certain size.

Put this to work

Research decision record

Use the question “Which parts of governance can be converted from document production into continuous evidence?” on a real case and produce a record another person can challenge.

For: Practitioners, researchers, founders, and operating leaders.
What you keep: A research decision record you can review, revise, and send.
What counts as sound: Answers a named decision
Separates evidence from assumptions
Includes the strongest contrary case
Names missing evidence
Ends with a test, owner, and date

The result is a working analysis. Check it against source evidence and qualified judgment.

Nothing entered here is stored or sent. Review the prompt before sharing confidential, personal, patient, or privileged information.

The caseName the organization, setting, product, or piece of work without including confidential information.The decisionWhat must someone decide, and who owns that decision?Evidence in handList records, observations, measurements, rights, or prior work that can be checked.What is still unknownName missing evidence, disputed assumptions, and practical constraints.

Review the prompt

Research decision record 1.0

PURPOSE
Use the question “Which parts of governance can be converted from document production into continuous evidence?” on a real case and produce a record another person can challenge.

CONTEXT
The case: Not provided
The decision: Not provided
Evidence in hand: Not provided
What is still unknown: Not provided

METHOD
1. State the decision.
2. Record facts separately from interpretations.
3. Apply the research method to the case.
4. Argue against the result.
5. Name the next test and the condition for stopping.

TASK
Use the method below to produce a Research decision record.

RULES
Separate facts, inferences, assumptions, estimates, hypotheses, and unknowns. Do not invent evidence, performance, rights, customers, economics, or regulatory standing. Quote or link the source for material facts. State uncertainty. Name what would disprove the conclusion. End with the smallest credible test, an owner, a decision date, and a stop condition.

A SOUND ANSWER
- Answers a named decision
- Separates evidence from assumptions
- Includes the strongest contrary case
- Names missing evidence
- Ends with a test, owner, and date

CAUTION
The result is a working analysis. Check it against source evidence and qualified judgment.

You can leave any field blank. The prompt will mark it as not provided.

If the record survives your review, send the question, evidence, unknowns, and requested next step.

Send us the result Intellectual Frontiers on LinkedIn

Experiments for this pillar

Map every requirement to an operational data source
How many requirements can be answered by a machine today?
Consent enforcement probe
Does a withheld consent change what downstream systems do?
How long does drift survive?
When a control is quietly disabled, how long before anyone notices?

Patterns and anti-patterns

Pattern
Store the query, not the screenshot
Keep the source, collection time, and query with the result so a reader can reproduce it. The same record is ready when an audit begins.
Anti-pattern
Writing a narrative where no data source exists
Requirements with no operational evidence source produce prose, and prose always passes. The absence never appears as a failure in any report.

See the full patterns register

Evidence for this pillar

NIST SP 800-53 revision 5, security and privacy controls
A large control catalogue, useful for mapping requirements to testable statements.
NIST Privacy Framework
A structure for privacy outcomes that can be mapped to engineered tests.
Compliant Insecurity
Collected material on organisations that satisfy their frameworks while remaining unable to detect, contain, or recover.
Operational Truth
The intended, reported, recorded, inferred, observed, and verified distinction used throughout this area.

Read the full evidence library

Notes under this pillar

Design Patterns

Generate the policy from the enforced rule
Where a platform enforces a setting, produce the written policy from that configuration. Then the rule and the document cannot drift apart.
2026-09-15

Operating Theorys

Governance runs short of time for judgment
When collecting and formatting evidence takes most GRC hours, little time remains for decisions. Automating the clerical work may give that time back.
2026-09-15