Home · Work · System design
Risk, compliance and auditBatch reconciliation and lineagelayered

RCSA evidence assembly

Risk and control self-assessment depends on fragmented incidents, metrics, control tests, changes and expert judgement across a defined period.

Approach

An evidence layer assembles the assessment population, identifies contradictions and drafts a rating rationale that keeps observation separate from judgement.

Organisations, systems and operating conditions are intentionally anonymised and recomposed. The design demonstrates engineering and banking-domain reasoning; it does not represent a named client estate, vendor product or measured production result.

Overview

System overview

Five operating planes separate interaction, identity, decision control, authoritative state and operating evidence.

RCSA evidence assembly: logical system architecture A five-plane architecture showing channels, access controls, twelve platform services, authoritative domain systems, evidence and operations. Solid nodes are active for this illustrative case; dashed nodes are optional platform capabilities. aSystem boundary and decision authoritySchematic architecture · illustrative scenario Experience planeAccess and scope planeDecision control planeAuthoritative data and effectsEvidence and operations rail Customer Channelweb · mobile · voiceStaff Decision Workspacereview · explain · approveOperations Control Roomincident · replay · withdrawRequest Ingress GatewayTLS · rate limit · schemaIdentity & Purpose GateOIDC · subject · consentPayload MinimiserPII policy · field maskCapability Directoryversion · scope · healthEvidence ContextCompilerContext & evidenceParty RelationshipResolverIdentity & relationshipsAuthority Rules EngineAuthority & policyJourney StateCoordinatorWorkflow & custodyTyped Action BrokerIntegration & effectsDecision ReceiptLedgerEvidence & auditReasoning RouteManagerModel executionEffective-DatedKnowledge HubKnowledge & rulesBehaviour EvaluationHarnessEvaluation & releaseOutcome RecoverySupervisorResilience & recoveryOperational Read ModelWorld state & read modelsDecision ReviewWorkbenchHuman decision & operationsPolicyauthoritative recordobligation registerauthoritative recordGRC workflowauthoritative recordcontrol evidence storesauthoritative recordaudit workpapersauthoritative record HTTPSHTTPSoperations context Immutable Evidence ArchiveTrace · Metric · Cost PipelineIncident · Replay · Custody Queue telemetryexceptions executed or authoritative pathproposal or optional capabilityevidence and telemetryactive in this case
Figure 1. The system boundary separates interaction, authority, business state and operating evidence. Solid services participate in this case; dashed services remain outside the admitted route. This is an illustrative system model, not a named deployment.

Permitted workThe system assembles evidence and tests obligations. Accountable control owners decide ratings, exceptions, findings and closure.

Consistency ruleLink each conclusion to effective obligation, control, population, test and owner; corrections append rather than erase prior evidence.

Hard boundaryThe model is not a system of record, identity provider, policy authority or proof that an external effect occurred.

Deployment

Deployment

Several sources must agree on balances, positions, costs or outcomes before a reporting or management decision can rely on them.

RCSA evidence assembly: deployment and trust-zone topology A production topology separates public edge, identity boundary, workload cluster, integration plane, data enclave and operating controls. Connections name transport and identity protocols, and a second region provides controlled failover. bDeployment topology and failure domainsLogical deployment · no measured estate data EDGE AND ACCESS PRIVATE WORKLOAD CLUSTER INTEGRATION AND DATA ENCLAVE OPERATIONS, EVIDENCE AND RECOVERY PLANE Web applicationfirewallTLS · bot · rate API ingressschema · quota Identity brokerOIDC · MFA Purpose gateclaims · consent HTTPStokensubject Regional traffic managerhealth · canary · failover Workload identity issuershort-lived service tokens Event & work queuepartition · DLQ · backpressure Secrets & key serviceenvelope encryption · rotation Evidence ContextCompilerzonal workloadAuthority RulesEnginezonal workloadDecision ReceiptLedgerzonal workloadReasoning RouteManagerzonal workloadDecision ReviewWorkbenchzonal workloadReserved workloadslotdisabledReserved workloadslotdisabledReserved workloadslotdisabled HTTPS · scoped JWT workload token async eventkey lookup IntegrationgatewaymTLSPolicysystem of recordobligation registersystem of recordGRC workflowsystem of recordcontrol evidence storessystem of record Model route enclavepolicy · schema · egress Qualified data storesSQL · graph · object Trace, metric & cost pipelineOpenTelemetry · redaction Decision receipt archiveappend-only · retention Reconciliation workersreadback · replay · DLQ On-call & review queuescustody · SLA · escalation Secondary-region standbycompatible manifest telemetryreceiptsexceptions
Figure 2. Workloads remain isolated from systems of record. Short-lived identity, typed integration contracts, append-only evidence and controlled failover define the deployable boundary; the topology is schematic.
Authority checkpoint

The system cannot assign the final risk or control rating.

Runtime

Runtime flow

A deterministic outer workflow contains model-led work inside typed, observable calls. Dashed messages remain proposals until policy or a human grants authority.

RCSA evidence assembly: event processing and recovery flow A five-lane event architecture shows authoritative producers, admission and ordering, evidence qualification, decision and effect handling, and the recovery rail. Late, duplicate and failed events follow separate paths to reconciliation and replay. cRuntime protocol and control pointsProtocol model · illustrative execution Authoritative producersAdmission and orderingEvidence and decisionEffect and reviewEvidence, reconciliation and replay Policyevent time · source versionobligation registerevent time · source versionGRC workflowevent time · source versioncontrol evidence storesevent time · source version Schema gateversion · identity · duplicatePartitioned event logentity key · watermark Enrichment workersbounded fan-out · freshnessDecision workerrule gate · bounded score Effect or review routetyped action · custodyOutcome verifierreadback · reconcile source eventsource eventqualified readqualified read admittedorderedcontextdecision Late-event correctionreopen · append · notifyDead-letter queuefault class · ownerIdempotent replaysame key · checkpointDecision receipt ledgerversions · basis · custodyOutcome monitorlag · drift · harm invalid / faileddelayed outcomecheckpoint replaydecision evidenceeffect receipt Consistency: A consumer sees one qualified batch version. Mixed source cut-offs or partial partitions cannot be presented as a complete period.
Figure 3. Event time, admission, evidence qualification, decision and delayed outcome remain separate. Late or failed events enter correction and replay paths with preserved lineage. The paths are protocol semantics, not an observed production trace.
S

State model

Batch and partition manifests remain immutable; reruns create new attempts. Published views point to the exact successful attempt and source cut-offs.

I

Integration choice

Use file or event arrival to trigger orchestration. Separate raw landing, canonical transformation, control calculation and consumer serving.

C

Consistency semantics

A consumer sees one qualified batch version. Mixed source cut-offs or partial partitions cannot be presented as a complete period.

Services

Services and interfaces

These roles are deliberately vendor-neutral. Each can be independently owned, versioned and replaced.

  1. CAS
    Context and evidence

    Evidence Context Compiler

    Accepts a typed evidence request and returns the minimum permitted facts with source, event time, observation time, validity and exclusions.

    Degraded routeExclude stale or unauthorised fields, ask a bounded question, or stop the route. Never fill a gap with an inferred fact.
  2. DES
    Evidence and audit

    Decision Receipt Ledger

    Appends request, versions, policy result, model proposal, approval, action receipt, readback, correction and custody events under one correlation key.

    Degraded routeBlock a consequential close when mandatory evidence is missing; keep the case open with an explicit evidence defect.
  3. MSG
    Model execution

    Reasoning Route Manager

    Chooses an approved model route by task, risk, evidence quality, latency budget and cost ceiling; enforces structured outputs.

    Degraded routeUse a smaller certified route, deterministic fallback or human queue. Never lower the control bar to meet latency.
  4. HRC
    Human decision and operations

    Decision Review Workbench

    Presents claims beside evidence, alternatives, uncertainty, missing information, permitted actions and current custody.

    Degraded routeRoute to a trained queue with the original sources and open work. The model summary is never the sole evidence available.
  5. PDS
    Authority and policy

    Authority Rules Engine

    Evaluates identity, purpose, capability, amount, risk tier and policy version; returns allow, deny, step-up or human-review with reasons.

    Degraded routeFail closed for effects and restricted data. Read-only explanation may continue only from approved public or customer-visible sources.
Figure 4. Each service exposes a typed contract and a defined degraded route. Coordination stays in the control plane while domain ownership remains outside it.
Data

Data and records

Durable records carry provenance, authority, effect and custody without turning a transcript into an uncontrolled memory store.

RCSA evidence assembly: state ownership and evidence lineage Authoritative source observations feed six versioned runtime records. Each record names a single write owner. An append-only event and evidence stream builds a disposable current-state projection and supports audit replay. dState lineage, ownership and temporal validityLogical records · fields are illustrative AUTHORITATIVE INPUTS · POINT-IN-TIME QUALIFIEDPolicysource version · observed atobligation registersource version · observed atGRC workflowsource version · observed atcontrol evidence storessource version · observed atqualified inputqualified inputqualified inputqualified input WRITE OWNER · Evidence Context CompilerRequest enveloperequest_idpurposeactor_refsubject_refversioned · attributable · retainedWRITE OWNER · Authority Rules EngineContext manifestcontext_idsource_refsource_versionobserved_atversioned · attributable · retainedWRITE OWNER · Typed Action BrokerCase statecase_idstatestate_versioncurrent_custodianversioned · attributable · retainedWRITE OWNER · Reasoning Route ManagerAuthority decisiondecision_idpolicy_versionrequested_capabilityoutcomeversioned · attributable · retainedWRITE OWNER · Behaviour Evaluation HarnessAction and effect receiptaction_ididempotency_keyinput_hashdispatch_statusversioned · attributable · retainedWRITE OWNER · Operational Read ModelCustody eventtransfer_idfrom_ownerto_ownerreasonversioned · attributable · retained APPEND-ONLY CASE EVENTS + DECISION RECEIPTSrequest hash · source versions · policy version · proposal · authority · effect readback · custody Operational current-state viewrebuildable projection
Figure 5. The record chain preserves source version, write ownership, authority and custody. Solid records are required in this scenario; dashed records remain compatible but dormant.
Consistency contractDomain source rule

Link each conclusion to effective obligation, control, population, test and owner; corrections append rather than erase prior evidence.

Choices

Trade-offs

The selected design is not universally superior. It is the safer fit for this boundary and failure cost.

  1. 01

    Prefetch context or acquire it when needed

    Selected path

    Prefetch stable, purpose-safe facts; acquire volatile facts on demand against a time-qualified snapshot.

    Rejected path

    Load a broad customer profile at session start.

    Cost acceptedThe selected design adds source calls and latency, but reduces stale data, excess exposure and accidental reuse.

  2. 02

    Mutable current-state record or append-only decision history

    Selected path

    Use append-only events plus a rebuildable current-state projection.

    Rejected path

    Overwrite the case row with its latest status.

    Cost acceptedReplay and storage are more complex, but point-in-time reconstruction and correction lineage remain possible.

  3. 03

    Use one frontier model for every step or a task-specific cascade

    Selected path

    Reserve larger models for residual reasoning after deterministic and smaller-model gates.

    Rejected path

    Send every request to the most capable available model.

    Cost acceptedRouting adds evaluation work and operational complexity, but controls cost, latency and unnecessary data exposure.

  4. 04

    Review every case or apply risk-tiered human checkpoints

    Selected path

    Keep people at irreversible, ambiguous and policy-exception points; sample lower-risk automated outcomes independently.

    Rejected path

    Require the same manual approval at every step.

    Cost acceptedRisk-tiering reduces review load but needs calibrated thresholds, sampling and immediate withdrawal of authority when drift appears.

  5. 05

    Reason over policy text at runtime or compile executable rules

    Selected path

    Compile stable decision logic and retain retrieval for explanation and residual ambiguity.

    Rejected path

    Ask a model to interpret the source document for every request.

    Cost acceptedRule compilation needs controlled change, but creates repeatable decisions, regression tests and clear exceptions.

Figure 6. Teal marks the selected route; coral dotted rules preserve the rejected alternative. Each decision states the cost accepted rather than presenting one architecture as universally superior.
Recovery

Failures and recovery

Retries are bounded by knowledge of business effect; unknown outcome remains visible, owned and independently reconciled.

RCSA evidence assembly: failure classification and recovery control flow Five failure sources converge on a classifier that distinguishes known no effect, known failure, unknown outcome, material evidence gaps and control-plane failure. Each state has an explicit recovery route, service degradation and evidence receipt. eFailure classification and recovery policyControl model · thresholds set by owners DETECTION POINTSEFFECT CLASSIFIERRECOVERY DECISIONSERVICE-SPECIFIC DEGRADATION Source dependencyA missing incident or changed control…Authority servicePolicy is unavailable, expired, or returns…Reasoning routeOutput fails schema, citation, grounding…Action pathTransport times out after dispatch & the…Evidence railReceipt or custody append fails after a… Outcome classifierattempt · idempotency · source readback ·… Known no effectSafe bounded retry with the same…Known failureNarrow, queue, compensate, or fail closed…Unknown outcomeRead back authoritative state before retry…Material evidence gapRetain custody & create an owned…Control-plane failureStop promotion or dispatch; restore the…Evidence Context CompilerExclude stale or unauthorisedfields, ask a bounded question, orstop the route. Never fill a gap…Decision Receipt LedgerBlock a consequential close whenmandatory evidence is missing;keep the case open with an…Reasoning Route ManagerUse a smaller certified route,deterministic fallback or humanqueue. Never lower the control bar…Decision Review WorkbenchRoute to a trained queue with theoriginal sources & open work. Themodel summary is never the sole…Authority Rules EngineFail closed for effects &restricted data. Read-onlyexplanation may continue only from… RECOVERY RECEIPTfault origin · classification basis · owner · retry/compensation key · readback reference · residual risk · resolved at classifier evidencerecovery evidence Pattern rule: Rerun failedpartitions idempotently,quarantine inconsistent outputs &…
Figure 7. Recovery follows the known business-effect state, not the transport symptom. Every branch ends in a receipt preserving fault origin, custody and reconciliation basis.
Capacity

Performance and capacity

Actual thresholds belong to accountable service owners. The design exposes the equations and observables that those owners must baseline.

Dependent variablesOperating
envelope
  • batch completion window
  • lineage coverage
  • reconciliation break age
  • rerun and backfill capacity
Capacity relationships
  1. 01required_throughput = input_rows / available_batch_window
  2. 02reconciliation_work = partitions x independent_control_sets
  3. 03rerun_headroom = remaining_window x spare_processing_rate
Privacy lens

Separate privileged, investigation and employee data from general model context; preserve legal-hold and access evidence.

Figure 8. The variables define what must be measured before capacity or quality claims can be accepted. Relationships are analytical scaffolds, not invented targets or production results.
Operations

Release and operations

A design is production-ready only when teams can prove what happened, recover it and change it safely.

Minimum release gates
  1. 01

    obligation-to-control coverage

  2. 02

    sampling and population integrity

  3. 03

    evidence freshness and independence

  4. 04

    finding closure and residual-risk approval

Figure 9. Promotion requires evidence at each gate and a compatible rollback route. No gate is implied to have passed; accountable owners set thresholds and sign the record.
Operating stateReleaseRecover
Evidence

Population definition, source completeness, control results, incident links, rationale citations, challenge and signed rating.

Human authority

Risk and control owners assign ratings and accept residual risk.

Evolution

Move high-value changes to event-driven refresh only after the batch control set can reconcile the new path against the established baseline.

Ownership

First-line control, second-line risk, compliance, audit and legal owners keep their separate decision rights.

Figure 10. Evidence, human authority, ownership and controlled evolution remain coupled throughout operation. Removing any quadrant breaks the assurance case.