1.9 KiB
Pitch Script
30-Second Opening
We started from an SDD Speckit OKR pipeline that was already strong in context, evaluation, and orchestration, but weak in Security, Governance, and AgentOps. The original assessment placed it around CASAN Level 3 to 4 transition. Our work turns H4/H5/H6 into runtime controls with verifiable evidence.
3-Minute Story
-
Problem: The original pipeline could generate documents and code, but it lacked production controls. Prompt injection, unclear approval, missing telemetry, and weak auditability prevented a solid Level 4 claim.
-
Approach: We added a CASAN harness layer around the pipeline:
- H4 filters input and output.
- H5 evaluates risk, denies high-risk actions by default, and writes tamper-evident audit logs.
- H6 records latency, cost, tokens, retry, status, and alerts.
-
Evidence: We added automated tests and evidence files. The test suite proves injection blocking, PII masking, governance denial/approval, audit-chain validation, metrics, alerting, and JSON trace validity.
-
Level 5 Demonstration: We added drift detection, model fallback, tool registry with idempotency, rollback transaction, business KPI feedback, signed central policy bundle, provider telemetry import, shared harness registry, and central dashboard.
-
Conclusion: Level 4 is achieved. Level 5 is demonstrated locally with verifiable controls. For enterprise production, the same interfaces can be connected to IdP, WORM storage, live provider telemetry APIs, and a hosted dashboard.
20-Minute Presentation Timing
| Time | Topic |
|---|---|
| 0:00-1:30 | Problem and baseline score |
| 1:30-4:30 | CASAN architecture |
| 4:30-8:00 | H4/H5/H6 runtime controls |
| 8:00-11:00 | Live verification output |
| 11:00-14:00 | Level 5 mechanisms |
| 14:00-16:00 | Dashboard and evidence map |
| 16:00-18:00 | Scorecard and claim boundary |
| 18:00-20:00 | Q&A setup |