// GLOSSARY

Canary Evidence

A traceable, harmless object placed into an environment on purpose to show that a control is actually enforced (for example a decoy credential, a marked document or a trap record). The most common fallacy in security is the gap between 'the policy is written' and 'the policy works'; a control being defined does not mean it fires in the field. Canary evidence closes this gap: rather than seeing that a control exists, it proves its decision is applied with an object designed to leave a trace when touched. It is used in the live validation of controls such as data-loss prevention (DLP), access monitoring or detection rules. Removing it from the environment at the end of the test and leaving no operational impact is a requirement of the side-effect control principle of controlled execution.