Role-Based Reader Journeys & Persona Pathways

Tier 1: Strategic Architecture · Audience: All Audiences · Normative Status: Informational / Navigation Guide
Prerequisites: What is TIDIR? · 15-Minute Golden Path

1. Navigating TIDIR by Organizational Role

TIDIR is an open target architecture spanning data pipelines, probability theory, software engineering, and operational governance. Because different security professionals approach the framework with distinct responsibilities and constraints, this guide maps targeted reading journeys for four primary roles:

2. The Four Persona Pathways

1. CISO & Security Executive Pathway

Your Core Challenges: Managing enterprise cyber risk, preventing catastrophic business outages caused by runaway automation, proving regulatory compliance to external auditors, and eliminating unsustainable vendor lock-in.

Key Architectural Answers in TIDIR:
- How does TIDIR prevent automated outages? Invariant 6 (Bounded Autonomy) and Invariant 7 (Security-State Monotonicity) guarantee that critical infrastructure is exempt from destructive isolation and that partial failures never regress security posture.
- How do we prove our defenses to regulators? Invariant 10 (Reconstructability) requires that every consequential decision is recorded in an immutable, cryptographically sealed Incident Decision DAG.
- How do we prevent vendor lock-in? Invariant 11 (Operational Portability) mandates vendor-neutral representations (OCSF, Apache Iceberg, Polyglot DaC, STIX 2.1).
Curated Reading Order (Total Time: ~20 minutes):
1. What is TIDIR? (Understand the core operating maxim: "Probabilistic components propose; deterministic components authorise")
2. The Architectural Constitution & 11 Invariants (Review the mandatory non-negotiable guarantees)
3. ADR-0010: SABSA Alignment & Attribute Profiling (Translate technical SLOs into business risk language)
4. Enterprise Adoption Roadmap (Assess the 4-phase brownfield migration strategy)
5. Target Threat Model & Assurance Case Map (Review the formal threat taxonomy and verification criteria)

2. Detection Engineer Pathway

Your Core Challenges: Eliminating alert fatigue caused by the Base-Rate Fallacy, testing detection rules before production deployment, escaping proprietary SIEM query languages, and correlating weak signals across disparate telemetry streams.

Key Architectural Answers in TIDIR:
- How do we test rules without deploying to production? Detection-as-Code (DaC) pairs vendor-neutral YAML metadata envelopes with target-optimized queries tested via automated CI/CD pipelines and 30-day historical lakehouse backtesting (ADR-0019).
- How do we prevent upstream pipeline changes from silently breaking detections? Inverted Telemetry Dependencies (ADR-0019) allow rules to declare required vs optional signals, automatically flagging operational status as DEGRADED when pipeline feeds stall.
- How do we stop alert fatigue? SRE Alert Noise Budgets (ADR-0008) enforce strict False Positive Rate (FPR) ceilings, automatically freezing deployments when a detection class burns its error budget.
- How do we correlate without streaming every raw log centrally? Distributed Detection & Finding Federation (ADR-0023) offloads commodity detections to edge domain controls while the central core executes cross-domain graph correlation.
Curated Reading Order (Total Time: ~25 minutes):

3. SecOps Lead & Incident Responder Pathway

Your Core Challenges: Triage overload, cognitive fragmentation across multiple consoles, understanding the root cause of automated actions, and ensuring manual break-glass controls remain accessible during crises.

Key Architectural Answers in TIDIR:
- How do analysts avoid cognitive fatigue? The Progressive Disclosure Analyst Workbench (INV-06) presents findings in a structured 3-tier hierarchy: Situation Report ➔ Evidence Summary ➔ On-Demand Graph Lineage.
- How do automated playbooks handle failures? Automated containment runs as a Forward-Compensating Saga (ADR-0005); if an API fails mid-action, defenses freeze in place or escalate outward rather than rolling back.
- How do we avoid vendor lock-in when automating response? Declarative Action Intents (Component: Response Automation) decouple response intent (e.g. ISOLATE_HOST, REVOKE_SESSION) from vendor-specific APIs, preserving evidence lineage across infrastructure migrations.
- How do we retain investigative intuition when AI automates routine triage? Continuous Operator Skill Retention Simulators (ADR-0020) run regular unannounced synthetic incident drills to prevent deskilling.
Curated Reading Order (Total Time: ~20 minutes):

4. Enterprise Security Architect Pathway

Your Core Challenges: Establishing component boundaries, verifying cryptographic trust models, securing non-human identities, mitigating prompt injection risks in agentic workflows, and ensuring high-availability distributed systems resilience.

Key Architectural Answers in TIDIR:
- How do we interface heterogeneous security products without copying all data centrally? The Three First-Class OCSF Interface Types and Detection Placement Policy Matrix (ADR-0023, System Overview) formally separate raw Telemetry (Categories 1, 3, 4, 6), standardized Findings (Category 2: Classes 2001/2004), and Entity Context.
- Where is the trust boundary for AI agents? The Agent Trust Boundary (ADR-0004) isolates reasoning models into the untrusted Analytical Plane; execution authority is held exclusively by deterministic policy kernels in the Defence Control Plane.
- How are machine credentials secured? Non-Human Identity Attestation (ADR-0018) issues task-scoped, ephemeral SPIFFE SVIDs valid for $\leq 15 minutes$ .
- What happens during an outage? Graceful Degradation (Plan B) (ADR-0021) defines four explicit operational tiers, automatically dropping down to local edge spooling and tabular timelines upon upstream service failure.
Curated Reading Order (Total Time: ~30 minutes):

3. Quick Reference Matrix by Topic

Technical Topic	Primary Invariant	Key Architectural Decision Record (ADR)	Core Specification Document
Telemetry Preservation & OCSF	`INV-01`	ADR-0002: Preserve Unmapped OCSF	Layer 2: Storage & Query
Authority Separation & Dual-Plane	`INV-04`	ADR-0004: Defensive AI Runtime	System Overview
Detection-as-Code & GitOps	`INV-11`	ADR-0019: Polyglot DaC	Layer 3: Intel & Detection
Distributed Finding Federation	`INV-01`, `INV-03`	ADR-0023: Distributed Detection	Layer 1: Data Sources
Exposure Management & CTEM	`INV-03`, `INV-04`	ADR-0022: Exposure Management	Threat Intelligence
Monotonic Automated Containment	`INV-07`	ADR-0005: Saga Containment	Layer 4: Incident Response
Ephemeral Machine Identity	`INV-05`	ADR-0018: NHI & Attestation	AI Orchestration
Incident Lineage & DAG	`INV-10`	ADR-0006: Evals-as-Code	Assurance Case Map

Role-Based Reader Journeys & Persona Pathways ​

1. Navigating TIDIR by Organizational Role ​

2. The Four Persona Pathways ​

1. CISO & Security Executive Pathway ​

2. Detection Engineer Pathway ​

3. SecOps Lead & Incident Responder Pathway ​

4. Enterprise Security Architect Pathway ​

3. Quick Reference Matrix by Topic ​