Same rules as the real engine.
Try the same incident at each level: Off just reports, Monitor plans without touching anything, Ask waits for your click, Auto gets on with it. The VPN scenario hides an attacker’s instruction in a log. Watch what Guardian does with it.
Choose an incident and a permission level, then press Start.
| Time | Stage | Action | Device | Result | Hash |
|---|
The diary entry is written when the incident closes.
Simulation for illustration. Scenarios are drawn from our exam, and nothing here connects to a real network. Hover an audit row to see how each hash links to the one before it.
Thinking is free. Acting is earned.
Guardian reads and reasons freely. Every change passes a fixed permission check first, takes a snapshot, verifies afterwards, and only closes when the original fault is re-tested. Instructions hidden in logs are treated as evidence, never obeyed.