01 · Mental model
Each capability has a distinct graph and definition of done
A document builder owns document structure and assembly, not every specialist decision. A security architect may request compliance interpretation or detection evidence. Sentinel work needs KQL schema and behavior checks. CSPM work reasons across subscriptions, connectors, recommendations, policy, and ownership.
The orchestrator lets these workflows diverge while preserving a common intake contract, artifact envelope, evidence record, policy checks, and final review boundary.
02 · Visual explanation
03 · Compare and decide
Different domains need different proof
| Decision lens | Capability | Required evidence |
|---|---|---|
| Document builder | Complete structure and consistent terminology | Source-linked decisions and resolved placeholders |
| Security architect | Trust boundaries and abuse paths | Findings with impact, evidence, and remediation |
| Sentinel | Data source and KQL semantics | Schema, fixtures, detection behavior, deployment scope |
| CSPM | Cloud hierarchy and posture controls | Connector, policy, recommendation, ownership, and rollout model |
04 · Cybersecurity example
A Sentinel design disagreement
The architect recommends broad telemetry while the delivery planner flags ingestion cost and ownership gaps.
Both specialists return evidence-linked artifacts.
The orchestrator identifies the conflict by shared decision ID.
A human selects scope and records rationale.
The document builder renders the accepted position consistently.
Outcome: Disagreement becomes a reviewable decision instead of being averaged into ambiguous prose.
05 · What to remember
The 60-second recall
Specialists need domain-specific evidence and tests.
The document builder assembles accepted decisions; it does not silently invent them.
Conflicts should be explicit artifacts with accountable resolution.
Teach-back prompt: Explain this concept to a teammate using the diagram, then name one failure mode and the control that stops it.
06 · Questions people ask
FAQ
07 · Primary sources