Evidence and Exports

A governed design has to leave the building: as review evidence, as documents other teams consume, and as machine-readable artifacts for pipelines. The Decisions & Value segment is where the package's evidence and exports live.

Evidence Capture

At the moments that matter (notably approval) the platform snapshots what the decision rested on: the control results and the design state, fingerprinted. Evidence is immutable once captured; it is what lets the Operate stage later say "this is what you approved" with precision, and what reviewers see summarized on the Review & Approval tab.

Document Exports

One menu produces the document set, generated from the live design so nothing is hand-maintained:

Export	What It Is
Solution design	The architecture document: components, flows, zones, decisions with rationale
SSP	System security plan aligned to your applicable controls
Traceability	Requirements mapped to the components implementing them
DFD	Data flow documentation with classifications and encryption posture
Threat model	The design's threat analysis
SBOM	Software bill of materials for the selected technologies
Terraform bundle	Infrastructure-as-code starter derived from the design (Azure concrete; AWS and GCP scaffolds)
Business Case	The funding-decision PDF

Downloads capture evidence as they generate, and a bundle export packages the set together.

Machine-facing Artifacts Live on Operate

The signed OPA policy bundle and the Terraform conformance check (validating a plan against the approved design) are pipeline tools, so they live with the conformance gate on the Operate tab; API-key authenticated for CI use.