List
Grid
Preview — rendered markdown
Where the evidence is today
Three of five sources are evidenced. Access logs, key rotation and the runbook are captured and replayable; the incident record and the vendor attestation are asserted in prose with no artifact behind them.
Gaps
AU-6— service accounts excluded from quarterly reviewIR-4— incident record is prose, not artifact
An unanswered control is evidence of a gap in the assessment, not evidence of compliance.
A table wider than the measure
| Persona | Claims processing | Policy lifecycle | Multi-channel comms | Document management | Automated data entry | Financial reconciliation | System integration | Real-time visibility |
|---|---|---|---|---|---|---|---|---|
| PER-002 | ✓ | — | — | ✓ | — | ✓ | — | — |
| PER-003 | ✓ | — | — | ✓ | — | ✓ | — | ✓ |
Preview — spreadsheet
| A | B | C | D | |
|---|---|---|---|---|
| 1 | Account | Type | Reviewed | Findings |
| 2 | svc-ingest | Service | 2026-08-21 | 0 |
| 3 | svc-export | Service | 2026-08-21 | 2 |
| 4 | t.eaves | Named | 2026-08-19 | 0 |
Diff — inline
Access reviews are performed Removed: quarterlyAdded: monthly by the Removed: system ownerAdded: security lead and recorded in theAdded: audit log.
Diff — side by side
Before
Access reviews are performed Removed: quarterly by the Removed: system owner and recorded in the log.
After
Access reviews are performed Added: monthly by the Added: security lead and recorded in theAdded: audit log.
Diff — by line
A removal is struck through and an addition underlined; by line, the gutter adds a sign. The tint is the second signal, never the only one.
File type is a mono badge and a glyph, never a coloured chip — a dozen tinted extensions is the wall of colour this system exists to avoid, and colour-coding by extension fails anyone who cannot separate the hues. Folders are the one exception, because they are navigation rather than content. The reader caps its measure at 72ch; a document pane stretched across a 27-inch monitor is unreadable.