CISO 5-Minute Proof

Is SMERC credible enough to test in shadow mode?

SMERC scores whether an AI-agent or automation action is recoverable enough to allow, throttle, freeze, deny, or escalate before execution. The decision here is not production certification. The decision is whether one observe-mode GitHub Actions pilot is worth discussing.

ALLOW THROTTLE FREEZE DENY ESCALATE

GitHub proof package Readiness report Pilot path

Five-Minute Review Path

From claim to pilot ask

Minute	Question	Evidence
1	What does SMERC claim?	CISO overview
2	What evidence exists now?	Credibility packet
3	How would a team install the first test?	Operator quickstart
4	Is the pilot package ready for week zero?	Readiness report
5	Is a 30-day observe-mode pilot worth discussing?	Pilot options

What would make this worth testing?

The workflow has real side effects.
Current controls do not explicitly score recoverability before action.
Constrained postures would be more useful than simple allow/block in some cases.
Metadata-only scoring is acceptable.
Reviewers can label agreement, overrides, false-release candidates, and false-constraint candidates.

What would kill the pilot?

No side-effecting workflow exists.
Existing controls already solve recoverability and rollback capacity well enough.
Reviewers cannot label decisions.
Metadata cannot be safely supplied.
The buyer expects production-certified enforcement immediately.

Recommended pilot ask

Run SMERC in observe mode against one GitHub Actions workflow for 30 days. Existing approvals remain authoritative. SMERC writes decision artifacts, reason codes, controls, replay IDs, and pilot metrics for reviewer comparison.

Review GitHub Actions pilot Open GitHub proof package Inspect repository

Claim boundary

SMERC should not be represented as production-certified, compliance-attested, customer-validated, or proven to reduce incidents until real pilot evidence supports those claims.