Demonstration and audit-execution recordings

FedRAMP 20x Class C: the audit, in brief

A short re-cut of the full assessment run below. It moves through all 46 Key Security Indicators in id order, keeping the live evidence pull on screen for each one, then closes on the completeness split. The per-indicator detail ships in the 3PAO Assessment Kit rather than in this cut.

Closing figures: 46 of 46 addressed, 36 at two or more methods, 46 at one or more, honest ceiling 40. The card reads "46 of 46 addressed", never "46 of 46 green".

Close

FedRAMP 20x Class C: live assessment run

Built as evidence for an assessor rather than as a sales pitch. The machine gathers and schema-validates each indicator's live drill-down against production; a human assessor reviews it. The 36 automated indicators show their machine envelope. The 10 human-review indicators carry an assessor remark covering what was tested, how, the evidence, the residual risk and the verdict.

A burned-in timer counts the genuine 7:16 machine pull, so the elapsed clock on screen is measured rather than staged.

Close

From Rev5 documents to 20x machine evidence

Five segments, narrated and captioned so it reads with the sound off. Leads with the live 20x summary, the marketplace record and a Key Security Indicator drill-down, then sets the Rev 5 document model against continuous machine evidence. The closing card cites FedRAMP ID FR2628647239.

Close

CMMC Level 2, machine-verified: brief cut

Rebuilt on 2026-08-13 against live production figures: 27 automated, 7 platform-native, 58 partial and 18 attestation-appropriate across the 110 requirements, with 82 of 110 carrying two or more independent deduped signals. 154 of the 320 objectives are machine-verifiable.

The cut also covers the four evidence schemas offered to the FedRAMP PMO on 2026-08-11. FedRAMP has not responded and has adopted nothing. The video says "offered", and so does this page.

73 of the 238 assessment considerations resolve to interviews, physical inspection or organizational judgment and are not expected to fall to automation. The cut frames that number as marking where the floor of human assessment sits.

Close

CMMC Level 2, machine-verified: full 110-control run

88 machine-validated controls pull live schema-validated evidence. The remaining 22 carry an assessor examine or interview remark: 8 inherited from AWS GovCloud FedRAMP High, 4 not applicable by architecture, 6 administrative and 4 on the endpoint posture roadmap.

The completeness card reads "110 of 110 addressed" and "Not 110 of 110 green", with a designed ceiling of 92 of 110 if the read-only posture module ships. The 88 of 110 is coverage of Advent's own boundary.

Close

Machine-validated CMMC evidence

The refreshed final cut. Coverage figures shown on screen were the ones current on the recording date.

Close

Credential revocation: one click, three refusals

Recorded on the production tenant with a real Touch ID passkey enrolled on camera. The alert keys on the browser and device signature, not on network address or location, and the email says so.

The click revokes what exists: with a passkey and a password both die; with a password alone the same click reports that no passkeys were registered and still signs out sessions and requires a new password.

The link only destroys. It creates nothing for anybody, so someone who follows it from a stolen mailbox locks the account rather than taking it over.

The session that was already open is shown being refused on its next request and sent back to the sign-in page, filmed on production.

Close

Accessibility, checked on every change

Opens with how accessibility is usually handled, a specialist audit every year or two, and why the result decays the day after: development carries on, and a colour change in a shared stylesheet can undo a fix that was signed off weeks earlier.

Then shows the checks running for real. The measurement driving a live browser through the sign-in page and again at a phone width, the same check in the build alongside the security and code quality checks, and a phone app measured on a device image.

The centre of the cut is a defect no automated rule could have found. The sign-in logo's text alternative was the word Logo, which every rule passes because it is a valid alternative. Listening to the page was what caught it, and the before and after announcements shown on screen are both real measurements taken on production either side of the fix.

Close

Build the form yourself

Opens on what a new form usually costs in people: a designer for the screen, a developer, a database developer, a DBA, a tester, a security reviewer, an accessibility reviewer, and someone to schedule the release. None of them is wasted, and the cut never argues otherwise. What it questions is whether all of that coordination is needed to get six fields onto a screen and into a table.

Everything after the opening cards is the live platform. A process is named in the designer, one step is made a manual task, the six field names are typed as that step's input, and one tick says the answers are to be kept. The platform creates the table, one column per name, and the first run stores exactly what was typed: a ZIP with a letter in it, and a street nobody was required to give. That is what a first draft looks like. The rules are then set as cells in the same grid the field names came from, and the form is run again.

The close answers the opening roster role for role. The platform's own execution engine runs the revised form from a workbook, without a person clicking, and files the result against the process. Accessibility is checked on every push, on the built product and again on the signed-in screens. Security and code quality are read from the record the platform keeps of itself.

Close

Reporting as a member of the public

One unedited run, driven from a workbook by the platform's own execution engine rather than by hand. It opens on the process diagram, fills the form, and closes on the same diagram with the executed path in colour and the form's completion statistics.

Partway through, the browser window narrows to tablet and then phone width so the same form is seen re-flowing rather than being described as responsive.

Close

Reporting as a healthcare provider

The second run reports a vaccine administration error with no adverse event. The adverse-event section is never asked for: absent from the form, absent from validation, and absent from the review page, with the progress indicator recalculating to fewer steps rather than skipping one.

Switching the report type back restores the section with the entered values intact.

Close

Configuring an FAQ, then using it

The configuration half is done through the same screens a non-developer would use, with no code and no deployment. The use half then shows the two audiences getting different answer sets from the one configured process.

Close

Site navigation survey

The conditional question is the point: the branching is configuration on the field, not a coded screen.

Close

Post-submission satisfaction survey

Close

The same survey in Spanish

Two coexisting processes rather than a language switch on one. Each keeps its own table, so the two languages cannot overwrite one another's responses.

Close

A form built as rows, not as a screen

No table is created by hand and no screen is coded. The closing beat is the rule row that ties one field's behaviour to another field's answer.

Close

The same environment in the mobile app

Captured from the device screen while the real application is driven through its own accessibility layer, so there is no browser window being resized to imitate a phone.

Close

Provisioning users and groups

The upload runs in add-or-update mode, which leaves existing accounts untouched, so the same file can be corrected and uploaded again without side effects. The account added by hand appears under its group beside the ones the spreadsheet created.

Close

Roles and what they may run

Authorizations are attached from the role card one at a time, or in bulk through a second upload on the same menu.

Close