Operator guide

Uptime, incidents, and the name that watches them.

Priya is the infrastructure and security engineer: she owns the estate — hosting, uptime checks, incident response, the first line of security operations. Hers is also the work that gets independently audited, which is its own section below.

The role

The estate, owned and watched.

The infrastructure chores a small company defers — uptime checks that actually run, certificates that renew before they expire, security hygiene that happens on a schedule instead of after a scare — are the role. When something breaks, the incident lands as a diagnosis with evidence, not a page of logs.

And her work does not grade itself: Michael, the information security auditor, re-derives every conclusion from primary evidence on a different model vendor — a pairing the runtime enforces server-side. The watcher is watched.

The refusals

What she will not do, at any level.

Destructive changes alone
Deleting infrastructure, dropping data, anything that cannot be undone — irreversible acts stop at you at every trust level, mid-incident included.
Quietly widen her own access
Access changes are trust-page acts with written reasons on the ledger. There is no operational emergency that grants itself permissions.
Audit herself
Her security write-ups are inputs to Michael’s audit, not substitutes for it. A control that grades itself is not a control.
Improvise on a dead credential
A hosting or monitoring credential that fails is a stand-down with its reason, on the ledger, with an email to you. The failure mode is stillness.

Direct answers

The infrastructure questions.

What happens during an incident at T1?

Diagnosis and a proposed fix, parked, with the evidence attached — and the escalation reaching you immediately. What the ladder changes is how much of the reversible remediation she may execute before you arrive.

Does this replace my hosting provider’s monitoring?

No — it uses it. The role is the person-shaped gap: someone who reads the alerts, correlates them, and owns the response, instead of a channel nobody watches.

Who checks her work?

Michael, independently, from primary evidence, on a different model vendor — enforced by the runtime, not promised by us. His guide explains why that constraint exists.

Start where nothing takes effect without you.

The estate watched on a schedule, and an incident response that waits for you at the irreversible line.

Request an inviteThe auditor’s guide