Automation Capstone

Brief

You have the pieces: version control, controls as data, policy as code, pipeline gates, OSCAL, APIs and tests. This room ships one control the whole way: from a record in a repository to a gate that blocks a merge and an evidence artefact nobody typed by hand.

Pick one control, take it end to end, and make every stage produce something a stranger could inspect six months from now.

A control is engineered when the pipeline, not a person, is the thing that says no.

The delivery spine

Six stages, and each one owes the next something concrete. The repository owes a versioned definition. The unit tests owe pinned fixtures. The policy tests owe a negative case that actually fails. The gate owes a fail-closed decision. Deployment owes a signed artefact. The final stage owes evidence with run metadata attached.

Break any one link and the chain reverts to a manual process wearing CI badges: the run is green, and nothing about the control is demonstrable.

The gate is the control

The moment a gate can be skipped with an undocumented flag, the control stops existing, not partially, entirely. Skips are legitimate; silent skips are not. The engineered version records who, why, and when it expires.

An exception with an owner and an expiry date is a control operating as designed. A skip flag in a workflow file is an unrecorded change of control design made by whoever was on call.

Evidence falls out of the pipeline

If someone has to remember to export the run, the automation ends at the gate. The pipeline should write the artefact itself: the decision, the control id, the run id, the inputs it evaluated and the population it covered.

Emit on both outcomes. A pipeline that only writes evidence when checks pass produces a record of the good days, which is precisely the period an auditor is not asking about.

Evidence only produced on success is a marketing artefact, not a control record.