Mark Peterson's trail

Relayed by Mark at the same session: security sets a posture as close to ideal as it can and deals with the gaps as they come up; an auditor needs to see that something went wrong and was corrected. His walk is owed before review stop 3.

Local feedback when qcontrol enforces a policy, with a path to IT: the seed of c133 and c137, and the promoted problem enforcement-without-local-context.

Wanted the person at the keyboard told, locally, when qcontrol enforces a policy, so enforcement is not unexplained disruption. The message channel's ports and bones ship in V1 because of it; the design is c137's.

On the roadmap session he asked that the person at the keyboard get an explanation and a path to IT when qcontrol enforces, so it is not a whiplash in a vacuum of information. The ask became the promoted problem this cycle cites.

When qcontrol enforces a policy the person sees a disruption and nothing else; he asked for local feedback with a path to IT. The enforcement notice and Contact IT are that ask, and the problem this cycle cites.

On the Aug 20 product review he asked for the score as a trend rather than a static number, and named the reports a security team hands out, including an inventory report, for people and for tools. c128 builds on that list through c78.

Set the order of support (OWASP LLM Top 10, NIST AI RMF and SOC 2 first) and the rule that support means mapping policies and evidence, not claiming compliance. On Oct 19 he described the flow: pick frameworks, let their policies come in, then except what you're not ready for.

Moved mode onto the policy and retired snooze; asked to see a change's impact before making it; kept expiry optional; proposed the team posture bar, propagation per version, config import and the onboarding-vs-mature demo. His intents PR #4 and v1 scope note set the cycle's scope.

On Oct 19 he moved the off / observe / enforce switch onto the policy, asked for findings to close with a reason instead of Block or Ignore, and pointed out that suppressed findings shouldn't pollute the stream. That afternoon on Oct 21 he called Snooze "not a thing anymore".

Wanted changes staged and versioned rather than live toggles (Oct 14), then argued the first version needs only one shared draft, with more only when customers show the need (Oct 21).

His intents repo set the model and vocabulary; he marked the delivery phase for every section. In sessions he asked for the session around a finding, an audit trail on every change, and separating closing the past from preventing the next one.

Reviewing the dashboard mocks in early September, he asked whether a person's token use is inside their plan or over it, because raw dollars mislead across billing models. Activity now leads with tokens.

Said his CFO keeps trying to rationalize AI spend and attribute it to departments, one of the page's three readers.

Said every security journey starts with inventory and discovery, the ground these overview pages stand on.

In the 2026-09-24 review notes, his line asking whether his finance team could predict the month's spend was the example the process review used for remarks that got lost. Runs now route such lines to a Voices list.

Cited: his Oct 21 story of offboarded intern laptops missing updates moved fleet-scale compliance to recurring. The record also names his product sessions (Oct 12–23) as the source of the decisions written into design c114, c116, c118 and c121.

On the product call that reviewed these pages, he said his CFO attributes AI cost to department; the notes in the cycle's folder record it as the buyer signal behind comparing teams on spend.

Cited: the record says his Sep 3 ask for AI spend broken down by department, driven by his CFO, landed as first-hand evidence, while the team's own claims in the same call were capped. His Aug 31 and Sep 3 calls were also the test cases the profiles were built on.

On the Sept 3 walkthrough he said full session transcripts would make him nervous in a demo and proposed customer-held keys; the second Session detail now states how transcripts are protected. He also asked whether the sensor sees browser AI, and called a personal account the headline for a user.

Cited: the record names his 2026-08-31 call as the cycle's source. He asked that each technology roll up under its company, that sensor gaps be something you can act on ("oh, crap. Alexis... investigate that"), that device lists come from the company's identity and device systems, and he backed blocking personal AI accounts.

On the Aug 20 product review he listed what a team does with a finding (acknowledge, ignore, make an exception, act now or ticket it, keep a record for auditors), gave his program's 14/30/90-day deadlines, and said the clock starts at discovery, not at triage.

On the Aug 20 product review he listed the reports a CISO hands out: SLA insights, an inventory like a bill of materials, a compliance snapshot and a board summary, each as a PDF for people and JSON or CSV for tools, and asked for posture as a trend, not a static score.

Cited: the record names the Moto call (Mark M, then tagged as a prospect fractional CISO, interest 5 of 5) as one of the two pilot calls. How to tag him, advisor or prospect, was left open here and settled in c11.

On the Aug 20 product review, a week before the three-card mock, he listed the reports a security team needs, including compliance, SLA insights and inventory status, and gave remediation deadlines by severity. The three cards follow that shape.

On the Aug 20 product review, eight days after it shipped, he called the framework toggles intuitive and familiar, and welcomed agent-specific policies such as the MCP server allow-list being pre-mapped.

Matched: on the Aug 20 product review he said there have to be at least three personas, GRC, IT ops and the engineers themselves. market-analyst added the end user as P12, "a gap in c55".