Decision and differentiation workspace #

Available

The /decision route connects GRC evidence to project, financial, reporting, integration and third-party decisions.

Security by Design #

A project record retains criticality, assets, data categories, requirements, risks, actions, deviations, milestones, security opinion and production decision. Its controlled workflow progresses from active to in progress and then completed.

Financial quantification #

Scenarios combine minimum and maximum frequency, minimum, most-likely and maximum loss, an indirect-loss factor, currency and model version. Human finance approval is required before simulation; the result is not an automated decision.

Views, reports and connectors #

360-degree views save filters, columns, grouping, periods and comparisons. Report templates require approval before execution and JSON, CSV or HTML export. Connectors declare provider, direction, conflict strategy and field ownership; reconciliation returns an auditable result.

TPRM portfolio #

The portfolio classifies third parties by segment, criticality and cyber score, raises alerts and applies reassessment frequencies. Always validate source data before contractual or budget decisions.

Decision PDF contents #

The PDF is no longer a JSON copy. It identifies organization, report type, template version, generator and approver, followed by a summary of risks, controls, assessments, actions and third parties. Approved blocks can detail the ten leading risks, priority actions and compliance position. It records that decisions remain human and explains methodology and source-data limits.

Workflows, rights and controls #

Risk managers progress Security by Design projects through POST /api/decision/projects/{id}/transition; inconsistent changes return INVALID_TRANSITION. A financial scenario can be simulated only after approval. Frequency and losses must preserve minimum ≤ most likely ≤ maximum with an explicit indirect-loss factor.

Report templates require approval before execution. A run creates a reproducible snapshot whose export accepts only pdf or json; PDFs are rendered server-side. Connectors require an administrator for reconciliation. Review conflict strategy and field ownership before bidirectional synchronization. Platform vision is super-administrator only.

Decision API #

Method	Endpoint	Purpose
`POST`	`/api/decision/projects/{id}/transition`	change project state
`POST`	`/api/decision/financial-scenarios/{id}/simulate`	calculate an approved scenario
`GET`	`/api/decision/views/{id}/snapshot`	return a frozen 360-degree view
`GET`	`/api/decision/platform-vision`	super-admin cross-platform view
`POST`	`/api/decision/reports/{id}/run`	execute an approved template
`GET`	`/api/decision/reports/{id}/export?format=pdf	json`	download the run
`POST`	`/api/decision/connectors/{id}/reconcile`	reconcile a connector
`GET`	`/api/decision/tprm/portfolio`	summarize third parties and alerts

Before a committee meeting, freeze the view, run the approved report, archive its PDF and retain JSON for automated comparison.