Operational sequence
- Normalize all event times to UTC.
- Build access and opportunity matrices.
- Preserve at least three competing hypotheses.
- Use compartmented canary information with authorization.
- Interview for chronology before motive.
- Require corroboration before irreversible sanctions.
Failure states
- Using diagnosis as a loyalty score
- Announcing a suspect before evidence collection
- Silent evidence alteration
- Unbounded surveillance of players