Skip to content
Pre-launch / First modules December 14, 2026.Lessons and community run on Skoolhttps://www.skool.com/dfir
The provenance standard

Practitioner authored.
Accountability, recorded.

A named practitioner owns the outline, judgment, lab verification and sign-off. AI may help create lecture material, labs or assessment items. The provenance record identifies those contributions, the model and version, and what the practitioner checked by hand. Human accountability does not mean hiding AI assistance.

By Rob T. Lee, creator of SIFT.

A named practitioner owns the work.

The practitioner owns the outline, judgment, lab verification and sign-off. AI assistance does not transfer that responsibility to a model.

What the record discloses

The module record identifies the author, version, AI-assisted components, model and version, manual checks on SIFT, and sign-off date. The structure alongside this text shows the required fields; it is not a signed record.

What a public module summary contains

When a module ships, its public summary identifies its title, named practitioner, objectives, case evidence, sources and provenance record, with a direct Skool lesson link. A summary is not the lesson or evidence of exam coverage.

All current modules are planned. Author names and signed records publish with released content, not invented for previews. The first signed record arrives with the first module release.

Read how modules are built
The human record
Fields required for every signed module record
Module / versionPractitioner / authorAI contributionModel / versionVerified by handSign-off / date

Record structure only. No module has been released, so no record is signed yet. The first signed record publishes with the first module.

Keep your judgment. Build your skills.

The examiner's work
starts with the evidence.

Last reviewed