See your cryptography.
Plan what comes next.

This lesson introduces the Sentinel console. Use a private local installation for approved customer metadata. The shared demonstration is synthetic only. Never upload secrets or real customer exports to a shared preview.

Step one. Enter your assigned username and password, then select Sign in. In this synthetic example, the administrator account is used. Viewers can read and export; analysts can import and create plans; administrators can approve planning packages.

Step two. On Overview, check the active snapshot in the top bar. Confirm its source, assessment date, evidence digest and synthetic label. These are stored assessments, not a live device feed.

Step three. Read quantum exposure, migration priority, migration difficulty and evidence confidence separately. Unknown is not zero risk. Check the known-asset denominators and control coverage. Difficulty is a conservative planning heuristic, not measured migration effort.

Step four. Open Inventory. Type a vendor, owner or algorithm into the filter, then press Enter. Use the asset-type selector to narrow results. Filtering changes the visible list; it does not change the stored evidence.

Step five. Click an asset row. Compare advertised, model and firmware supported, enabled, and observed-used capabilities. Inspect rule outcomes and score assumptions. A marketing claim is not proof of configuration or application use.

Step six. Close the detail drawer and select Log out when finished. Keep account access and evidence review within your assigned workspace. Continue with the evidence and findings lesson to build a reproducible assessment.

This lesson follows evidence into findings and reports. Step one. Open Evidence and download the synthetic fixture JSON. Native vendor exports are not supported collectors. The current import contract accepts CAS metadata JSON or CSV, and one public certificate in a private installation.

Step two. Select Import evidence. Choose the synthetic JSON file and set the assessment date to October ninth, twenty twenty-six for this practice fixture. Current customer reviews should use their actual assessment date. Never include private keys, credentials, card data or recovery shares.

Step three. Select Import. The new snapshot contains normalized inventory and versioned rule results. Uploaded verified claims are downgraded to self-reported. Missing, stale or conflicting evidence cannot silently pass. A rejected file is not retained as accepted evidence.

Step four. Open Findings and click a result. Read the outcome, severity, rule identifier, rule version, source digest and evidence pointer. Unknown and manual review require attention; they are not passing assessments.

Step five. Open Policies and select Load policies. Review applicability, required evidence, remediation and source publication status. These are internal assurance controls. Algorithm recognition does not establish module validation, regulatory compliance or end-to-end readiness.

Step six. Return to Overview. Choose Report Markdown, JSON or CSV for the intended reviewer. Download the CBOM only as the CAS-owned schema; it is not validated CycloneDX or SPDX interoperability. Preserve the assessment date, digest and rule versions with the report.

Step seven. In Evidence, load the audit record and declared connectors. Check event history and each connector's limitations. Local audit chaining does not prove against whole-database rollback without an external trusted anchor. No vendor connection is initiated by viewing this catalog.

This lesson builds a reviewable migration plan without executing changes. Step one. Open Dependencies. Inspect observed, user-confirmed and inferred relationship labels and confidence. The graph displays supplied edges; it is not measured discovery and may be incomplete.

Step two. Open Migration. Select the synthetic signing HSM and choose ML-DSA as an illustrative signature planning target. ML-KEM is for key establishment, not signatures; AES is a symmetric cipher. A menu choice is not proof of vendor compatibility.

Step three. Select Generate planning package. Read affected services, prerequisites, evidence gaps, validation, rollback and residual risk. Execution remains false. The model is a dependency-based planning aid, not a measured digital simulation or change authorization.

Step four. Open a finding and select Create remediation package. The package keeps the finding's rationale and evidence with a proposed target state. This action creates a review record only; no key, HSM or application is changed.

Step five. Return to Migration and load packages. Assign the responsible team, select In review and save. Analysts cannot approve. An administrator may select Approved only after reviewing the package; this approval covers the plan, not operational execution or risk acceptance.

Step six. Confirm the stored Approved state for this synthetic example. Before real change work, obtain separate change authority, exact-version documentation, compatibility tests and operator-owned rollback. Sentinel does not perform those changes.

Step seven. With two comparable snapshots loaded, choose a baseline and select Compare snapshot drift. Inspect added, removed and changed metadata fields. This example changes a synthetic owner. Differences are between supplied snapshots, not observed live-device drift.

This lesson covers specialist review workspaces. Step one. Open HSM assurance. Review owner, firmware, dual-control and backup-test metadata, then open device evidence for the associated rule outcomes. Synthetic vendor examples are not native integrations or health measurements.

Step two. Scroll to the ceremony custody template. It represents three primary cards and three backup cards across three custodians. The authorization threshold remains unknown. Do not infer a quorum, copy card contents or use this template as vendor ceremony instructions.

Step three. Open Payment review. Inspect the explicitly synthetic merchant, controlled-service and external-party trust boundaries, along with stored service findings. This view does not process transactions, detokenize data or provide a PCI attestation.

Step four. In a private local installation, select Import evidence and choose one public PEM or DER certificate. This recording uses only the supplied public synthetic certificate. Shared demo mode rejects certificate imports. Never upload a private-key file or certificate bundle.

Step five. Open Certificates. Inspect issuer, declared public-key algorithm, encoded expiry and evidence status. Use the filter to find a certificate. The renewal window is configurable in CAS metadata policy; the default is thirty days.

Step six. Click the certificate and inspect its rule results. An encoded-validity pass proves neither trust-chain validity nor endpoint deployment. RSA is flagged for quantum exposure even when a certificate has not expired. Chain, revocation and interoperability remain unverified.

Step seven. Return to Overview and export the certificate assessment. Route evidence gaps and remediation proposals to the responsible owner. Use the setup guide for private deployment and backups; these videos cover console use, not production accreditation or device-changing commands.