Map identities and authority.
Identify the human, service and worker identities involved in a project. Define their permitted resources and actions, credential lifecycle, approval requirements and revocation path.
Locate the enforcement point.
Determine which system actually constrains each action. Instructions in a prompt are not a substitute for tool authorization, process isolation, network policy or data access controls.
Keep evidence appropriately scoped.
Record enough to support review and recovery without collecting unnecessary sensitive data. Place operational evidence in a system with the required access and retention controls.
Assess the real deployment.
Evaluate updates, dependency trust, backup, incident response and the behavior of disconnected components. Any compliance, certification or isolation claim needs evidence for the particular environment.