{
  "author": "Adrian Sutherland",
  "edition": "Version 1.0",
  "prepared": "2026-09",
  "copyright": "2005–2026 Adrian Sutherland",
  "diagrams": [
    {
      "id": "security-access",
      "title": "Access to the case",
      "summary": "Identity, policy and business state govern an action.",
      "kind": "graph",
      "nodes": [
        {
          "id": "request",
          "label": "Person or service",
          "description": "Authenticated identity requests a case action.",
          "x": 70,
          "y": 50
        },
        {
          "id": "policy",
          "label": "Access policy",
          "description": "Policy owner defines permitted subjects, resources, actions and context.",
          "x": 510,
          "y": 50
        },
        {
          "id": "enforce",
          "label": "Service enforcement",
          "description": "Establish current permission before access or change.",
          "x": 290,
          "y": 210
        },
        {
          "id": "case",
          "label": "Case and receipt",
          "description": "Accepted state changes remain atomic and traceable.",
          "x": 70,
          "y": 370
        },
        {
          "id": "observe",
          "label": "Review and response",
          "description": "Protected observations inform investigation and policy changes.",
          "x": 510,
          "y": 370
        }
      ],
      "connections": [
        {
          "to": "enforce",
          "label": "Identity and request",
          "from": "request"
        },
        {
          "to": "enforce",
          "label": "Decision and conditions",
          "from": "policy"
        },
        {
          "to": "case",
          "label": "Permitted action",
          "from": "enforce"
        },
        {
          "to": "observe",
          "label": "Decision and result",
          "from": "enforce"
        },
        {
          "to": "policy",
          "label": "Changed risk or access",
          "from": "observe"
        }
      ],
      "caption": "Fictional design for discussion. Arrows show relationships or feedback. Tailor the roles and activities to your method."
    },
    {
      "id": "security-cycles",
      "title": "Security decision cycles",
      "summary": "Decisions retained through change and use.",
      "kind": "graph",
      "process_areas": true,
      "nodes": [
        {
          "id": "visioning",
          "label": "Visioning",
          "description": "Business and risk owners agree protection needs, direction and tolerable exposure.",
          "x": 20,
          "y": 340
        },
        {
          "id": "transforming",
          "label": "Transforming",
          "description": "Teams select and implement controls, check them and prepare support.",
          "x": 340,
          "y": 340
        },
        {
          "id": "operating",
          "label": "Operating",
          "description": "Owners maintain access, observe controls, handle incidents and restore service.",
          "x": 660,
          "y": 340
        },
        {
          "id": "governing",
          "label": "Governing",
          "description": "Accountable owners review policies, assurance, exceptions and remaining risks.",
          "x": 340,
          "y": 25
        }
      ],
      "connections": [
        {
          "from": "visioning",
          "to": "transforming",
          "label": "direction"
        },
        {
          "from": "transforming",
          "to": "visioning",
          "label": "reconsider"
        },
        {
          "from": "transforming",
          "to": "operating",
          "label": "accepted change"
        },
        {
          "from": "operating",
          "to": "transforming",
          "label": "improvement"
        },
        {
          "from": "governing",
          "to": "visioning",
          "label": "priorities"
        },
        {
          "from": "governing",
          "to": "transforming",
          "label": "change authority"
        },
        {
          "from": "governing",
          "to": "operating",
          "label": "policy"
        },
        {
          "from": "operating",
          "to": "governing",
          "label": "findings"
        }
      ],
      "caption": "Version 1.0 · September 2026 · © 2005–2026 Adrian Sutherland. The arrows show selected exchanges and feedback. Work can repeat within any area or reopen a wider decision. Governing applies to direction, change and operation; the areas can overlap. Retain accepted decisions between cycles."
    }
  ]
}