Operational sequence
- List every person and system with plausible access.
- Identify what the credential or log actually authenticates.
- Seek a second modality that connects an actor to the action.
- Evaluate motive only after the action evidence is stated without motive language.
- Match the consequence to the weakest unresolved link.
Failure states
- Credential equals person
- Access equals action
- Motive repairs missing attribution
- Role or diagnosis substitutes for proof