The service itself is on the cast list. It writes read records, export records and key-use records into itself, which makes it both the largest producer of a certain class of event and its own most sensitive subject.
The platform operator's goal is stated as a constraint: run it above 99.99% while being structurally unable to read a record. If that reads as awkward, it is the architecture working.
The fourth group — the weekly verifier, the nightly disposer, the reconciler, the replicator — has SLAs and failure paths of its own. Leaving these off a cast list is how they end up unowned.
What this fixes
Every capability later in the set traces to a goal here. A view that serves none of these is scaffolding for one that does.
The three journeys that carry the value are marked on their cards and mapped in views 05 to 07.
Assumptions
38 investigators, 12 compliance officers and 4 legal hold officers across the estate (assumed, sized from a mid-size regulated enterprise).
External auditors are appointed by the regulator and are assumed hostile to the service's own claims about itself — which is the correct posture, not a pessimistic one.
