c9 Plan — Meaning Before Data

Context

c6 proved the dashboard structure and the full inventory model. c8 expanded bob-wire's ability to sketch richer relationship and abstraction patterns.

c9 builds on both:

• use c6 as the baseline dashboard
• use c8 as the expressive grammar
• redesign the wireframe experience around significance, posture, evidence, and next-step clarity

Design Premise

The dashboard is not only a place to inspect data. It is a place to understand whether something is normal, risky, unclear, or urgent.

The top of a page should answer:

• what matters
• why it surfaced
• how confident we are
• what its blast radius might be
• where to drill next

The raw data table should still exist, but later in the page and with clearer framing.

High-Level Workstreams

1. Security operator research lens

Frame every redesign decision around the security operator's mental model:

• 10-second question: what demands attention?
• 60-second question: why is it concerning?
• 5-minute question: what evidence supports that?
• 15-minute question: what action should follow?

2. c6 audit

Review the c6 wireframes and identify where they are:

• data-rich but meaning-thin
• visually dense before significance is established
• table-led when a pattern summary would be better
• missing confidence, novelty, comparison, or blast-radius cues

3. Signal taxonomy

Define the signals that deserve elevation above raw rows:

• unknown
• new
• unusual
• sensitive
• concentrated
• unstable
• spreading
• low-confidence

4. Meaning-layer patterns

Establish reusable page patterns such as:

• posture banner
• threat bundle
• relationship spotlight
• change since last seen
• reason surfaced
• confidence marker
• blast-radius summary
• suggested next inspection

5. Proving-ground wireframes

Redesign five pages first:

1. Home
2. Security overview
3. Inventory overview
4. Sessions index
5. API keys index

These pages will test whether the meaning layer is understandable without redesigning the entire dashboard at once.

Research Tracks

Track A — What security actually cares about

Questions:

• Which unknowns change the posture of the whole page?
• What kinds of change deserve elevation even without explicit policy violations?
• What combinations of signals indicate likely risk vs benign novelty?

Output:

• prioritized list of operator questions
• mapping of questions to page patterns

Track B — Showing meaning instead of only evidence

Questions:

• How can a page summarize the issue before exposing the full evidence set?
• How do we present "normal vs unusual" in a way that feels obvious?
• Which comparisons are most meaningful: peer, historical, or policy-based?

Output:

• summary pattern options
• comparison heuristics

Track C — Noise reduction

Questions:

• Which stable and expected signals should collapse into summaries?
• Which tables should move lower on the page?
• Which repeated fields should become tags, legends, or annotations rather than columns?

Output:

• de-emphasis rules
• page simplification checklist

Track D — Signal amplification

Questions:

• Which signals should always appear above the fold?
• How do we show multi-entity relationships as one coherent threat?
• What is the smallest useful evidence bundle?

Output:

• top-signal hierarchy
• evidence bundle templates

Most Critical Signals To Amplify

1. Unknown credential in active use
2. Unknown user or unresolved endpoint attached to live activity
3. Sensitive file access in a currently active or recently ended session
4. New outbound destination, especially unencrypted or rare
5. Known identities behaving in new combinations
6. Concentrated spend or activity on a single model, key, or session
7. Capability or MCP error spikes that may indicate degraded trust or instability
8. Low-confidence attribution where security decisions still need to be made

Page Strategy

Home

Lead with:

• top risks now
• what changed since yesterday
• stable vs unstable zones
• recommended next drill

Reduce:

• pure KPI emphasis
• broad inventory count scanning as the main job

Security Overview

Lead with:

• active concerns grouped by significance
• why each concern matters
• confidence and blast radius

Reduce:

• simple lists of issues without interpretation

Inventory Overview

Lead with meaning buckets instead of entity buckets:

• unknowns
• sensitive touchpoints
• active exposures
• new entities and new combinations

Sessions Index

Lead with significance summaries:

• sessions needing review
• sessions normal by pattern
• sessions unusual by cost, access, or destination behavior

API Keys Index

Lead with credential trust posture:

• known vs unknown
• active risky credentials
• keys by blast radius and unusual use

Deliverable Shape

This cycle should produce:

• a redesign thesis
• a reusable signal taxonomy
• a first brief set
• a small number of high-value comparison wireframes

The comparison should make it easy to answer:

• what c6 shows
• what c9 adds
• whether the added abstraction helps or confuses

Build Order

1. Finalize c9 docs and brief set
2. Audit c6 pages against the taxonomy
3. Create c9 gallery scaffold
4. Build the five proving-ground wireframes
5. Compare c6 vs c9
6. Decide whether to expand to more inventory pages