Response Board

The action layer (Playbook Engine in motion). A kanban-style board drives each incident through the response lifecycle: active playbook, open actions, SLA breaches (overdue), closures and post-remediation tests. The hard rule: no action closes without validation — proof is required that the fix actually works.

Response state SIMULATION

Response kanban

Actions table (response_actions) SIMULATION

status ∈ {open, triage, contained, remediated, verified, closed}. The transition to closed is blocked until the evidence_id column points to remediation proof in CONFIRMED status (see Evidence Board).

Action status lifecycle

Closure rule (validation) — pseudo-guard

function canClose(action) {                 // SIMULATION
  if (action.status !== "verified") return false;   // no test = no closure
  const evd = evidence(action.evidence_id);
  if (!evd || evd.status !== "CONFIRMED") return false; // remediation proof required
  if (evd.confidence < 75) return false;             // proof must be strong
  if (action.type === "legal_report" && !action.filed_receipt)
      return false;                                  // regulator report = filing confirmation
  return true;                                        // only now → closed
}

Response board principles

Related