Phase 6A — Operational Evidence Execution Board

Requested: Confirmed federated participation map per source and object class

Why required: BC-01 cannot be retested without a declared participation mode per source.

Minimum acceptable: Attributable participation declaration per source/object.

Preferred: Architecture-signed participation map with failure behaviour.

Alternative acceptable: Per-source owner emails consolidated and countersigned.

Not accepted: Design-team-authored assumption of participation.

Evidence ref: — none

Requested: Participation mode, interface mechanism, authentication and failure behaviour for permit/JHA/isolation objects

Why required: Q4 objects gate work authorization; unverifiable source must fail closed.

Minimum acceptable: Owner statement of mode + authority boundaries.

Preferred: Owner-approved interface specification.

Alternative acceptable: Governed snapshot or controlled manual federation declaration.

Not accepted: Inferred API capability or vendor marketing material.

Evidence ref: — none

Requested: Document snapshot authority and revision-change notification behaviour

Why required: Decision pinning depends on governed revision snapshots.

Minimum acceptable: Owner confirmation of snapshot authority and validity window.

Preferred: Signed snapshot governance note (ADR-05 input).

Alternative acceptable: Manual controlled export under governance.

Not accepted: Assumed export permissions.

Evidence ref: — none

Requested: Look-ahead read participation and refresh cadence

Why required: Forecast context requires a governed schedule source.

Minimum acceptable: Owner confirmation of read mode and cadence.

Preferred: Scheduled governed extract.

Alternative acceptable: Periodic controlled snapshot.

Not accepted: Ad-hoc unsanctioned file sharing.

Evidence ref: — none

Requested: Subsystem completion participation mode

Why required: Release gating consumes completion state.

Minimum acceptable: Owner confirmation of participation mode.

Preferred: Governed read interface statement.

Alternative acceptable: Controlled snapshot.

Not accepted: Assumed availability.

Evidence ref: — none

Requested: Enterprise interface hosting, network and data-movement authorization

Why required: No participation is real without IT authorization.

Minimum acceptable: IT authorization statement for the declared mechanisms.

Preferred: Architecture review record.

Alternative acceptable: Conditional authorization with named constraints.

Not accepted: Verbal assurance without attribution.

Evidence ref: — none

Requested: Identity provider, authentication method and Pilot identity provisioning plan

Why required: Authority enforcement must be enterprise-enforced, not prototype-simulated.

Minimum acceptable: IAM owner confirmation + provisioned identity set.

Preferred: Signed IAM design and provisioning record.

Alternative acceptable: Time-boxed Pilot identity scope with revocation controls.

Not accepted: Prototype role-context behaviour.

Evidence ref: — none

Requested: Role resolution source and mapping to area / activity / shift / risk scopes

Why required: Attribute-based authority is unenforceable without a role source.

Minimum acceptable: Documented mapping from enterprise roles to authority scopes.

Preferred: IAM-owned mapping artefact.

Alternative acceptable: HR-sourced role feed with IAM endorsement.

Not accepted: Design-team role table.

Evidence ref: — none

Requested: Delegation and revocation behaviour confirmation

Why required: Delegation must never widen scope; revocation must fail closed.

Minimum acceptable: Written enterprise behaviour statement.

Preferred: Demonstrated revocation in a controlled test with real identities.

Alternative acceptable: Documented procedure with named enforcement owner.

Not accepted: Simulated revocation results.

Evidence ref: — none

Requested: Authoritative person-to-role source for Pilot population

Why required: Role resolution requires an authoritative person source.

Minimum acceptable: HR confirmation of authoritative source and update cadence.

Preferred: System-of-record extract governance note.

Alternative acceptable: Controlled snapshot with steward.

Not accepted: Spreadsheet of assumed personnel.

Evidence ref: — none

Requested: Acceptance of lifecycle ownership and transition authority per object

Why required: Lifecycle is defined by design and accepted by nobody.

Minimum acceptable: Decision artefact per object class.

Preferred: Signed lifecycle authority matrix.

Alternative acceptable: Minuted governance decision with attributable authority.

Not accepted: Design specification restated as acceptance.

Evidence ref: — none

Requested: Confirmation of transaction lifecycle authority boundaries at the federation edge

Why required: Prevents accidental duplication of Q4 authority.

Minimum acceptable: Owner confirmation of who may transition what.

Preferred: Joint authority boundary statement.

Alternative acceptable: Documented exception list.

Not accepted: Assumed boundary.

Evidence ref: — none

Requested: Named, authorized and available stewardship appointments (7 roles)

Why required: Vacant stewardship forces fail-closed HOLD in operation.

Minimum acceptable: Appointment records with authorization and capacity.

Preferred: Signed appointment letters with delegates.

Alternative acceptable: Interim appointments with explicit validity and escalation.

Not accepted: Org-chart names without authorization or capacity.

Evidence ref: — none

Requested: Capacity allocation and SoD confirmation for stewardship roles

Why required: Assignment without capacity is not stewardship.

Minimum acceptable: Capacity statement per role.

Preferred: Formal resourcing record.

Alternative acceptable: Time-boxed allocation with review date.

Not accepted: Best-effort verbal commitment.

Evidence ref: — none

Requested: Segregation-of-duties assessment for steward / owner combinations

Why required: SoD breach would compromise authority separation.

Minimum acceptable: Compliance SoD assessment.

Preferred: Signed assessment with conditions.

Alternative acceptable: Conditional acceptance with compensating control recorded.

Not accepted: Self-assessment by the design team.

Evidence ref: — none

Requested: Retention basis and period per material record class

Why required: Retention currently rests on a design proposal, not a legal basis.

Minimum acceptable: Competent retention decision per class.

Preferred: Signed retention schedule extract.

Alternative acceptable: Interim retention decision with review date.

Not accepted: Design proposal RC-RET-01 restated.

Evidence ref: — none

Requested: Personal-data classification, minimum attribute and access scope decision

Why required: Person and health-adjacent data must be minimised by decision, not assumption.

Minimum acceptable: Privacy decision per class.

Preferred: DPIA-equivalent record.

Alternative acceptable: Conditional approval with narrowed attributes.

Not accepted: Design minimum-attribute proposal alone.

Evidence ref: — none

Requested: Confirmation that only a binary fitness flag may be consumed

Why required: Prevents duplication of medical records.

Minimum acceptable: Health owner confirmation of exposed attribute.

Preferred: Signed data-exposure statement.

Alternative acceptable: Documented restriction with custodian.

Not accepted: Assumed minimum exposure.

Evidence ref: — none

Requested: Formal election of PATH_A or PATH_B for critical control participation

Why required: Path ambiguity propagates unresolved scope into BC-08 and Phase 7.

Minimum acceptable: Attributable path election.

Preferred: Path A with source owner authorization.

Alternative acceptable: Path B with DecisionAuthority, Reason, PilotEvidenceLost, ResidualRisk, Phase7Impact.

Not accepted: Continuation of SIMULATED_ONLY as an implicit decision.

Evidence ref: — none

Requested: Source participation authorization for critical control verification records (Path A)

Why required: Path A is unachievable without the owning system.

Minimum acceptable: Owner participation confirmation.

Preferred: Governed read of verification records.

Alternative acceptable: Controlled snapshot of verification status.

Not accepted: Inferred integration.

Evidence ref: — none

Requested: Named L1 / L2 / L3 owners, operating window and escalation path

Why required: Design-team dependency invalidates support sustainability.

Minimum acceptable: Staffing record with operating window.

Preferred: Signed support model with named staff.

Alternative acceptable: Interim model with explicit expiry and escalation.

Not accepted: Design team named as L2/L3.

Evidence ref: — none

Requested: Execution of operational drills S-01 → S-06 by the real support function

Why required: Support capability must be demonstrated, not described.

Minimum acceptable: Drill records with actor, outcome and time.

Preferred: Six executed drills with independent observation.

Alternative acceptable: Partial drill set with documented gap and plan.

Not accepted: Simulation campaign drill results.

Evidence ref: — none

Requested: Nomination of a real CV-07 workfront with owner, window and work demand

Why required: BC-08 has no real workfront; all ten dimensions are design-only.

Minimum acceptable: Nomination record with named field owner and window.

Preferred: Approved workfront nomination with SIMOPS context.

Alternative acceptable: Provisional nomination with confirmation milestones.

Not accepted: Illustrative or synthetic workfront.

Evidence ref: — none

Requested: Confirmation of crew, equipment, materials and field prerequisites for the nominated workfront

Why required: Dimension-level confirmation is required; no aggregate assertion accepted.

Minimum acceptable: Per-dimension attributable confirmation.

Preferred: Function-signed readiness confirmation.

Alternative acceptable: Conditional confirmation with named residual gap.

Not accepted: Blanket statement of readiness.

Evidence ref: — none

Requested: SIMOPS context and field prerequisite confirmation for the nominated workfront

Why required: SIMOPS cumulative rules require a real concurrent-work picture.

Minimum acceptable: ES&H confirmation of concurrent work context.

Preferred: Signed SIMOPS assessment for the window.

Alternative acceptable: Interim assessment with review trigger.

Not accepted: Prototype SIMOPS scenario.

Evidence ref: — none

Requested: Source and owner confirmation for the 12 frozen BEFORE metrics

Why required: Collection cannot start without a confirmed source and owner per metric.

Minimum acceptable: Per-metric source and owner confirmation.

Preferred: Signed measurement plan.

Alternative acceptable: Partial confirmation with metric-level status.

Not accepted: Assumed data availability.

Evidence ref: — none

Requested: Formal authorization to start prospective BEFORE collection

Why required: BEFORE is time-irreversible and must precede any Pilot exposure.

Minimum acceptable: Attributable collection-start authorization.

Preferred: Signed start record with date and scope.

Alternative acceptable: Staged start per metric with recorded dates.

Not accepted: Retrospective reconstruction of any kind.

Evidence ref: — none

Requested: Non-intrusive observation access that does not alter current ways of working

Why required: Collection must not itself contaminate the baseline.

Minimum acceptable: Access confirmation with non-intrusive conditions.

Preferred: Documented observation protocol.

Alternative acceptable: Restricted observation windows.

Not accepted: Any activity classified PILOT_INTERVENTION.

Evidence ref: — none

Lifecycle transition authority is only technically enforceable once identity and authority resolution are real.

Path A critical control participation requires governed source participation.

A Path B rescope removes the critical control source from the required participation set.

Stewardship authority must be enforceable where authority enforcement applies.

Support model cannot be staffed or bounded without governance ownership.

Field readiness scope depends on whether critical controls participate in the Pilot.

The measured population must correspond to the real workfront — but collection must start before exposure.

No Pilot execution may commence before the prospective BEFORE baseline is underway.

Measurement records must sit inside an approved classification and retention basis.

Why: NOT_ELIGIBLE — EvidenceQuality = NONE. Eligibility requires ≥ SUFFICIENT_FOR_RETEST.

Evidence refs: — none received

Acceptance criteria to test: Signed or attributable owner confirmation per source/object stating participation mode, authority boundaries and failure behaviour. Governed snapshot or controlled manual federation is acceptable where sufficient for CV-07 — live API is not demanded and never inferred.

Residual dependencies: External system owners outside the design team; enterprise change windows.

Why: NOT_ELIGIBLE — EvidenceQuality = NONE. Eligibility requires ≥ SUFFICIENT_FOR_RETEST.

Evidence refs: — none received

Acceptance criteria to test: IAM owner confirmation of provider, authentication, role resolution, delegation and revocation, plus a provisioned Pilot identity set. Prototype identity behaviour is explicitly not closure evidence.

Residual dependencies: Enterprise IAM programme and cyber approval cycle.

Why: NOT_ELIGIBLE — EvidenceQuality = NONE. Eligibility requires ≥ SUFFICIENT_FOR_RETEST.

Evidence refs: — none received

Acceptance criteria to test: Competent-authority decision artefact per object class accepting lifecycle ownership and transition authority. May close faster than BC-01/BC-02 because it is a decision, not an integration.

Residual dependencies: BC-02 for technical enforcement of transition authority.

Why: NOT_ELIGIBLE — EvidenceQuality = NONE. Eligibility requires ≥ SUFFICIENT_FOR_RETEST.

Evidence refs: — none received

Acceptance criteria to test: Attributable appointment records with authorization, named delegate, allocated capacity and SoD confirmation. A name on an org chart is SUPPORTING_EVIDENCE only.

Residual dependencies: Organizational resourcing decisions outside the programme.

Why: NOT_ELIGIBLE — EvidenceQuality = NONE. Eligibility requires ≥ SUFFICIENT_FOR_RETEST.

Evidence refs: — none received

Acceptance criteria to test: Competent decision artefact per material record class covering classification, retention basis, minimum attribute and custodian. No duplication of HR/Health source records is permitted.

Residual dependencies: Privacy and legal review cycle.

Why: NOT_ELIGIBLE — EvidenceQuality = NONE. Eligibility requires ≥ SUFFICIENT_FOR_RETEST.

Evidence refs: — none received

Acceptance criteria to test: One explicit, attributable path election. Path B must never be chosen merely to facilitate closure.

Residual dependencies: Critical control system owner authorization (Path A) or executive rescope (Path B).

Why: NOT_ELIGIBLE — EvidenceQuality = NONE. Eligibility requires ≥ SUFFICIENT_FOR_RETEST.

Evidence refs: — none received

Acceptance criteria to test: Staffed support model plus real drill records for S-01 (user/access), S-02 (mapping conflict), S-03 (rule question), S-04 (interface failure), S-05 (authority issue), S-06 (evidence reconstruction). Simulation drills are not operational drill evidence.

Residual dependencies: Support resourcing and service-window commitment.

Why: NOT_ELIGIBLE — EvidenceQuality = NONE. Eligibility requires ≥ SUFFICIENT_FOR_RETEST.

Evidence refs: — none received

Acceptance criteria to test: Attributable confirmation per dimension from the accountable field function for a real, nominated CV-07 workfront.

Residual dependencies: BC-06 path election where Critical Controls apply; construction sequencing.

Why: NOT_ELIGIBLE — EvidenceQuality = NONE. Eligibility requires ≥ SUFFICIENT_FOR_RETEST.

Evidence refs: — none received

Acceptance criteria to test: Attributable collection-start record plus a sufficient prospective data window per metric. Inference of collection is prohibited.

Residual dependencies: Field data availability; strict precedence over any Pilot exposure.

Blockers: BC-01 (→ BC-06, BC-03)

Basis: Longest external lead time on the board; every federated decision depends on declared participation.

Competent authority: Enterprise Architecture + System Owners

Blockers: BC-02 (→ BC-03, BC-04)

Basis: External lead time plus downstream enforceability of all lifecycle and stewardship authority.

Competent authority: IAM / Cyber

Blockers: BC-06 (→ BC-08)

Basis: Path ambiguity propagates unresolved scope downstream; the decision itself has short lead time.

Competent authority: ES&H Accountable Executive

Blockers: BC-09 (→ Phase 6B)

Basis: Time-irreversible: the BEFORE baseline cannot be reconstructed once behaviour changes.

Competent authority: Project Controls + Business Product Owner

Blockers: BC-03, BC-05

Basis: Decision artefacts, not integrations — they can close materially faster than BC-01/BC-02.

Competent authority: Business Product Owner · Records Management · Privacy

0 closed, 0 CWC, 0 rescoped, 9 REMAINS_OPEN.

Contradiction register empty — no external evidence received.

9 dependency edges unresolved; BC-02→BC-03, BC-06→BC-08 and BC-08→BC-09 all unsatisfied.

BC09Protection ACTIVE, PilotExposure PROHIBITED, no contamination event.

Phase 5 / Phase 6 baselines consumed unchanged; simulation baseline frozen.

Zero OperationalClosureEvidence items received; 28 requests awaiting owner.

Previous state: IEW — 9 blockers REMAINS_OPEN, EvidenceQuality NONE

New state: OEB established — Operational Evidence Execution Board Rev.1 instantiated

Trigger: Phase 6A Operational Evidence Execution Board authorization

Evidence ref: OEB-BASELINE-001

Actor / authority: Programme governance

Previous state: Simulation campaign SIMULATION_BASELINE_ACCEPTED_WITH_FINDINGS

New state: SIMULATION_BASELINE_ACCEPTED consumed as design assurance only

Trigger: Simulation findings closure (F-SIM-04, F-SIM-05)

Evidence ref: SIMCLOSURE-001

Actor / authority: Design authority

Previous state: Evidence requests: 24 (IEW)

New state: Evidence requests: 28 issued, all AWAITING_OWNER, 0 received

Trigger: Owner-based request register expansion under the Board

Evidence ref: OEB-ER-REGISTER-001

Actor / authority: Evidence acquisition lead