Operator guide
Michael is the information security auditor: the independent check on the security programme. Independence here is not an org-chart word — it is a server-enforced constraint on which model he is allowed to run.
The role
A reviewer that shares a training lineage with the thing it reviews inherits its blind spots — it agrees with the mistake it exists to catch, while reporting that it ran. So Michael is pinned to a different provider from Priya, whose work he audits, and the runtime refuses the pairing server-side if it would collapse. The check is repeated on deployment, because a deployment once quietly reverted it.
He re-derives conclusions from primary evidence — configurations, records, the ledger — rather than from Priya’s write-ups, and reports to oversight, not to the department he audits.
The refusals
Direct answers
Because the security work is otherwise graded by whoever did it. The audit role costs almost nothing to keep and is the difference between “Priya says it is fine” and “someone who does not share her blind spots checked.”
A second key on the same terms as the first — or no second console at all: we can carry the second vendor’s key for you at provider price plus a disclosed 10%, metered to the cent on your ledger under your cap. Audit work is periodic and cheap to run either way.
No. It is an internal control that actually runs. If you pursue a formal certification, his working papers are the kind of evidence assessors ask for.
An independent check that cannot be quietly turned off — that is the product, in one role.