The short version
- A control narrative is an attestation about configuration. A retest that reruns the original route and is refused is a demonstration about behaviour. Assessors accept the first and operators depend on the second.
- Configuration drifts between assessment and reality, so every closed finding is a claim with an expiry date. The only honest way to renew it is to run the route again.
- Evidence is written to the node's ledger first and exported in the shape your assessors already work from, which means no screenshots and no quarterly scramble to reconstruct what happened.
- This produces evidence and mappings. It does not produce an authorization. That decision stays with your authorizing official, and any vendor telling you otherwise is selling something that does not exist.
Ask an ISSO what the hardest part of an authorization package is and almost nobody says the technical controls. They say assembling the evidence: chasing screenshots from four teams, reconciling a scanner export against a control narrative written eight months earlier, and defending a statement about a boundary device that nobody has actually tested since the last assessment.
The work is hard because the artefacts are secondhand. A screenshot is a photograph of a claim. A scanner result is a statement about a component. Neither one answers the question an assessor is really asking, which is whether this system still behaves the way the package says it does.
What an authorization actually asserts
Strip the ceremony away and an authorization is a decision made on a date, using evidence gathered before that date, about a system that continues to change afterwards. The Risk Management Framework is honest about this, which is why it ends on Monitor rather than on Authorize. The monitoring step is where most programs then struggle, because the tooling that produced the original evidence was built for an assessment event rather than for a continuing obligation.
The gap between assessment and reality
Drift is not misconduct. A boundary rule gets edited during an outage at two in the morning and nobody reopens the ticket. A firewall is replaced and the rule set is migrated by hand. A group membership is added for a migration and never removed. Each of those is a reasonable act by a competent person, and each of them can quietly invalidate a sentence in a control narrative that will not be read again for months.
Every route you close is a claim with an expiry date. The package does not know that. The plant does.
This is the same argument we made about closing a cross-domain attack path, arriving from the compliance side rather than the operations side. Closing the route was not the deliverable. Proving it stayed closed was.
Attestation and demonstration
Consider one finding, the unsigned Modbus write path from our reference environment. The control narrative sentence reads something like: the OT boundary denies unsigned writes originating from corporate address space. That is an attestation. It is true when written, it is checkable by reading a configuration, and it will still be sitting in the package long after someone has edited that rule.
The demonstration is different in kind. Red reruns the original route, plus the write variants around it, and each attempt is refused at the boundary while Sentinel records that it saw all of them. That produces four things a configuration review cannot: proof the deny path executes, proof the detection fires, a timestamp, and a repeatable procedure that can run again next month without anyone rewriting it.
The control families above are not a surprise to anyone who works in this space, and that is the point. A validated path with a retest is not exotic evidence that needs a new category invented for it. It lands in the places an assessor already looks, which is why the export is built to arrive in the shape they already work from rather than as a vendor report they have to translate.
Written on the node, not gathered afterwards
The reason this can be produced on demand rather than assembled under deadline is that the recording happens at the point of action. Every run, every finding, every approval, every containment action and every login is written to the node's own ledger first. Streaming to Splunk, Microsoft Sentinel, Elastic or ServiceNow happens second, when a link exists.
That ordering matters more than it sounds. If the record is written centrally first, then a site with an intermittent link has gaps in its evidence exactly when the interesting things happened. If the record is written locally first, the site is the authoritative source and the central copy is a convenience.
What an assessor can check without a screenshot
The export is a manifest plus the objects it references, signed, with a hash chain so that tampering is detectable rather than merely discouraged.
finding KYB-004 unsigned modbus write reaches PLC-07
discovered 2026-08-22 atlas graph query, no packet sent
narrative boundary denies unsigned writes from corp-vlan
plan KYB-004-C1 guardian, validated in twin first
approved 2026-09-10 security_owner + process_owner
retest 2026-09-21 red 3 of 3 attempts denied
observed 2026-09-21 sentinel 3 of 3 attempts recorded
next 2026-10-19 scheduled, after the change window
artifacts replay-set-004, retest log, rule diff, twin result
digest sha256, chained to the previous ledger entry
scope this node, this site, this authorization boundaryAn assessor reading that does not have to trust a vendor console. The retest procedure can be run again in front of them. The narrative sentence and the behavioural proof sit next to each other, and where they disagree, the disagreement itself is the finding.
On standing access
Kybernao staff have no standing access to a deployed node. That is worth stating in a supply chain discussion, because the usual follow-up question is what a vendor could see if it wanted to, and the answer should not depend on the vendor's good intentions.
Evidence from a site with no link
Programs that operate at the tactical edge have the same obligation and none of the connectivity. This is where a cloud-first compliance tool quietly stops working: the evidence it needs to produce lives in a service the site cannot reach, so the package for those sites gets assembled by hand, late, from memory.
Because the ledger is local and the export is a file, a disconnected site produces the same artefact as a connected one. It is carried out rather than streamed out. The chain is intact either way, which means the shape of the package does not change based on how good the satellite was that quarter.
What this does not do
It does not authorize anything. Kybernao produces evidence and control mappings; your authorizing official makes the risk decision, and no amount of automated evidence changes who signs.
It does not replace your assessor's judgement, and it does not turn a finding into a waiver. What it does is narrow the argument to something verifiable. Instead of debating whether a control is implemented, the conversation moves to whether the demonstration was recent enough, which is a much better argument to be having.
If your program is working toward ongoing authorization rather than a three year cliff, the question worth asking of any tool in the package is simple: can it prove this control worked today, without a person taking a picture of a screen?