Watch the Market, Not the User / design diagrams

Decision flows, supporting boards and model evidence. All shapes, labels and connected arrows are editable in the native Excalidraw files. Open a downloaded file in Excalidraw to revise it. SVG and PNG exports are ready to share.

From signal to a justified investigation

Inspect the aggregate before choosing how much detail to reveal.

Editable ExcalidrawSVGPNG
From signal to a justified investigation
Read the diagram as text
  1. Notice an unusual channel
  2. Compare value and participation
  3. Explain the aggregate or inspect a pseudonym
  4. Request only the identity scope needed
  5. Record the disposition and re-mask

The boundary is an access decision

An access request has a reason, scope, and end state.

Editable ExcalidrawSVGPNG
The boundary is an access decision
Read the diagram as text
  1. Aggregate evidence needs no individual reveal
  2. A reason unlocks pseudonymous inspection
  3. Identity needs a case and bounded scope
  4. Wider scope requires a second approval
  5. Leaving the investigation returns to masking

Reveal only the evidence the decision needs

Access boundaries and exit behavior

Editable ExcalidrawSVGPNG
Reveal only the evidence the decision needs
Read the diagram as text
  1. 01 / Aggregate
  2. 02 / Pseudonym
  3. 03 / Identity
  4. Channel movement
    Value + participation
    Concentration
  5. Explain the reason
    Inspect scoped detail
    Retain the evidence
  6. Case + bounded scope
    Extra approval when
    scope is wider
  7. No identity reveal
  8. Justified inspection
  9. Reveal has an end
  10. Leave the investigation → re-mask
  11. Design check: can the analyst explain why each extra access level was needed?

Access ladder / reason, scope and expiry

The access policy and the audit events that make it inspectable

Editable ExcalidrawSVGPNG
Access ladder / reason, scope and expiry
Read the diagram as text
  1. Level / action
  2. Required evidence
  3. Recorded boundary
  4. Aggregate
  5. No identity reveal
  6. Alert and rule context
  7. Pseudonym
  8. Recorded reason
  9. Scoped inspection
  10. Identity request
  11. Reason, case, justification, scope
  12. One counterparty / seven-day boundary
  13. Wider request
  14. Approver B note
  15. Approval or decline recorded
  16. Leave alert or view
  17. Re-mask identity
  18. Append-only exit event

Four events / four evidence routes

All four events share aggregate-first investigation and a recorded rationale

Editable ExcalidrawSVGPNG
Four events / four evidence routes
Read the diagram as text
  1. Event / character
  2. Disposition
  3. Identity scope
  4. E2 / broad increase
  5. Explained at aggregate
  6. No identity reveal
  7. E3 / persistent drift
  8. Escalated: channel trend
  9. No identity reveal
  10. E4 / linked across rails
  11. Escalated: system-level
  12. No identity reveal
  13. E1 / concentrated change
  14. Escalated with justified reveal
  15. Bounded individual scope
  16. Each rationale joins the audit line; 3 of 4 events are resolved without identity.

Same events / different alert rules

Seeded event check; these results do not establish production performance

Editable ExcalidrawSVGPNG
Same events / different alert rules
Read the diagram as text
  1. Evidence check
  2. 2025 / mean + SD
  3. 2026 / calendar + MAD
  4. E1, E2 and E4
  5. Caught
  6. Caught
  7. E3 / persistent drift
  8. Missed
  9. Caught on day 2
  10. E5 / calendar false alarms
  11. 6
  12. 0
  13. Compare visible-window statistics with trailing calendar context.
    A view change must not silently redefine an alert rule.