Meaning-Layer Dashboard

c6 successfully mapped the AI observability domain into a complete dashboard shell and full inventory model. It proves that the information exists and can be navigated.

What it does not yet fully prove is the interpretation layer:

• what matters right now
• why it matters
• what changed
• what is unusual
• where a security person should look next

This cycle treats the dashboard as a lantern, not a ledger. The goal is not to replace the raw entity views, but to add a useful abstract layer above them so the security person can orient quickly and drill in with confidence.

Redesign the c6 wireframe dashboard so it surfaces meaning before raw data: posture before inventory, signal before count, and narrative before table.

1. Define a meaning-first redesign thesis for the dashboard
2. Audit c6 pages through a signal-vs-noise lens
3. Establish a signal taxonomy for AI observability in a security workflow
4. Create a first proving-ground brief set for meaning-first wireframes
5. Redesign a focused subset of c6 wireframe pages as c9 explorations
6. Compare c6 raw-data-first patterns against c9 meaning-first patterns

Out of scope:

• redesigning the c6 mockups
• final production interaction design
• replacing inventory detail pages with generated risk scores only
• removing raw evidence tables from the product entirely

1. CYCLE.md
2. plan.md
3. signal-taxonomy.md
4. briefs/README.md
5. Five proving-ground briefs for the first redesign pass
6. stories/ narrative framing documents for the redesign
7. A c6 audit and comparison notes as the wireframes are built

Pending. This cycle is the exploration path for redesigning the dashboard around security meaning, not just AI observability data coverage.

The dashboard should help a security person answer three questions in order:

1. What is happening that matters?
2. Why does it matter?
3. What should I inspect next?

c9 explores how to turn AI observability from "many rows of telemetry" into "clear operational understanding."

• abstraction above inventory
• security posture over raw telemetry
• signal amplification
• noise reduction
• evidence bundling
• relationship-centered risk framing
• confidence and blast-radius communication
• suggested next-drill paths for investigation

1. What actually matters to a security person in the first 10 seconds?
2. Which signals are meaningful alone, and which only matter in combination?
3. How do we show "normal vs unusual" without overwhelming the page?
4. What should be hidden until drill-down?
5. How do we communicate confidence, uncertainty, and novelty?
6. Which kinds of AI activity become materially important only when connected together?

• unknown identity
• unknown credential
• unknown endpoint
• new entity or new combination
• sensitive file access
• unusual outbound traffic
• concentration of spend or activity
• capability or server error spikes
• confidence gaps in attribution
• blast radius across related entities

The first pass should focus on five pages:

1. home-meaning-layer.md
2. security-posture-board.md
3. inventory-meaning-layer.md
4. sessions-significance-ledger.md
5. api-key-risk-story.md

These five pages are enough to test:

• whole-system orientation
• security interpretation
• meaning above inventory
• session significance framing
• one concrete entity-risk story

The proving ground has now expanded beyond those first five pages to cover meaning-layer list and detail stories for every c6 inventory entity type. That broader sweep tests whether the abstraction approach generalizes across the full inventory model instead of working only for sessions and API keys.

c9 is successful if the redesign makes it easier to:

• identify the top 3 things that matter
• distinguish normal from unusual behavior
• connect evidence across entities
• explain why a risk was surfaced
• see what to investigate next without reading every row

• Cycle created
• Meaning-layer plan drafted
• Signal taxonomy drafted
• Proving-ground brief set defined
• c9 wireframe gallery scaffolded
• First proving-ground wireframes built
• Meaning-layer inventory entity coverage built
• Narrative framing stories captured
• c6 page audit captured
• c6 vs c9 comparison notes captured