Methodology Outcomes Deliverables Insights Notes Readiness Scope brief

Proof · Guardrails

What done looks like

Guardrails is a fixed-fee engagement. Buyer and Yellow Theme share one definition of done — not a slide of vanity metrics, and not “we shipped whatever was in the kickoff plan.”

Use this page to decide if Guardrails is the right package. During delivery, each outcome is checked off only when there is concrete proof — a repo path, a workflow run, an export — not a status meeting claim.

Six outcomes

Importance is a priority signal for the engagement — High items unblock the rest. Evidence is how we prove the row, not a product logo wall.

Policy

High

A policy-as-code baseline for the stack in scope — rules that live in git and can be reviewed like any other engineering change.

Evidence · Repo path plus a pull request that lands the baseline.

CI

High

Security gates on pull requests and main — SAST, dependency, secrets, and image checks as scoped for your pipeline — so reviews catch issues before merge.

Evidence · Workflow file in the repo plus a link to a passing run.

Evidence

High

An assessor-ready index that maps each in-scope control to an artifact and the steps to reproduce it — so security reviews are not a screenshot scavenger hunt.

Evidence · Export from the engagement Evidence vault.

Backlog

Med

A prioritized remediation list ordered by audit impact, so the team knows what to fix next when something is partial or deferred.

Evidence · Plan card or markdown in the client repository.

Access

High

Least-privilege access only: a scoped GitHub invite and cloud assume-role path — no pasted keys in chat, email, or tickets.

Evidence · Status on the workspace Access / Updates trail.

Non-goals

Low

Explicit out of scope for honesty: we do not replace your GRC tool, we do not embed in Slack as a staff substitute, and we do not guarantee an audit pass.

Evidence · Named in the SOW and FAQ — stays on the board for the life of the engagement.

How we close the loop

You and Yellow Theme track the same six outcomes through the engagement. When something is done, we point at the evidence — then you can verify it yourself. That is the bar, not a kickoff deck or a percentage-complete slide.

See how delivery works

Methodology, sample deliverables, or a three-minute scope brief.

Methodology Sample deliverables Scope brief