Under FedRAMP 20x a provider validates its own Key Security Indicators continuously, in code. That moves the independent assessment question: not "does the SSP say the right thing", but "does this validation actually test what it claims, over the whole boundary, and fail closed when it should". This walkthrough follows one real KSI through all six steps — and ends where it matters, with the provider and the independent assessor recording different conclusions, separately attributed.
A KSI is a security outcome, not a control citation. The provider states the outcome, the pass criteria that demonstrate it, and the Rev5 controls it stands in for — so the claim stays traceable to the catalog an assessor already knows.
The provider submits the machinery, not just the answer: the query that produces the verdict, the evidence sources it reads, how often it runs, and what counts as a failure. This is the artifact an assessor examines — and the one a document review never sees.
SparkAE compares what the validation reads against what the authorization boundary contains, and reads the method for the failure modes that quietly turn a check into a rubber stamp. It reports findings. It does not decide.
The assessor reads the method themselves and designs probes against the same boundary. A validation that passes its own pipeline and fails an independent probe is the finding — and only an independent party can produce it.
This is the step the architecture exists for. The provider's conclusion is not overwritten, corrected, or merged. It is recorded as the provider's, beside the assessor's, each with its own evidence and reasoning — so a reviewer can see exactly where the two parties diverged and why.
The record that leaves the system carries the evidence, the method that produced it, the result, and the independent conclusion — each signed by the party that authored it. A reviewer downstream can verify who said what without trusting the system that stored it.
fails_closed: false travels with the record, not just the verdictdivergence: true is a first-class field, not an exceptionThe public engine does not produce FedRAMP 20x deliverables. This walkthrough is illustrative: it shows the shape of a validation-assurance flow, and nothing on this page is produced by the engine this origin publishes, which is the Rev5 Examine engine on the demo. The KSI identifier, theme, pass criteria, and Rev5 control mappings are the real entries from the CR26 KSI catalog; the provider system, validation code, challenge tests, and signatures are constructed to show the shape of the flow. FedRAMP 20x support is not part of this product and is not sold — see what the engine assesses today.
The browser demo assesses a synthetic sample SSP against the full FedRAMP Low baseline — 156 controls, 981 objectives — entirely on your machine. No signup, no upload, no network calls.
Public preview This build runs the engine, not a recording. It reads the documents you give it and computes every determination in the baseline. Those determinations are automated EXAMINE preparation an assessor checks, not an authorization decision, and their accuracy rests on a small published case set rather than on real authorization packages — what the engine gets wrong is published beside what it gets right: the accuracy benchmark →. This describes the public build in this repository, not the commercial server product.