Skip to main content

Deliverables

The Production Evidence Pack

Every engagement on this site ends with the same flagship deliverable: a structured evidence pack your engineering, security and procurement reviewers can actually assess — scope, findings, reproducible test records, a residual-risk register and a full access history, plus deployment runbooks and rollback plans where implementation is in scope.

Consultancy that ends in a slide deck leaves your reviewers with nothing to check. Ours ends in documents with evidence attached — because “trust us” is not something a security or procurement team can file.

See a sample finding

A synthetic example, not a customer finding.

The common spine

The spine every edition is built from

Each service delivers its own edition of the pack. Most items appear in all four editions; the deployment runbook and rollback plan appear where implementation is in scope. Every row names its intended audience and its applicability, so nothing has to be assumed.

Production Evidence Pack contents, intended audience, purpose and which engagements include each item
ItemForApplies toPurpose
Scope statement & exclusionsEngineering, procurementEvery engagementExactly what was covered, what was not, and why.
Findings or design documentationEngineering, securityEvery engagementSeverity-ranked findings (audit) or architecture and design rationale (implementation engagements).
Client verification recordEngineering, QAEvery engagementThe named clients tested, the agreed conditions, and the recorded results — reproducible, not anecdotal.
Residual-risk registerSecurity, procurementEvery engagementWhat remains open at handover, why it was not closed, who owns it, and what would close it.
Deployment runbook & rollback planOperationsImplementation engagementsHow to deploy the change safely, and the documented path back if something goes wrong.
Security & access recordSecurityEvery engagementWhat access was granted, how credentials were handled, and confirmation of removal at handover.
Methodology & limitations noteSecurity, procurementEvery engagementWhat was examined and what was not — so nobody relies on coverage that was never claimed.

The deployment runbook and rollback plan apply where implementation is in scope. The Readiness Audit makes no code change, so it assesses deployment and rollback posture rather than producing those documents. The Enterprise Pilot additionally exercises the rollback in a non-production environment.

The methodology and limitations note matters as much as the findings: it states what was examined and what was not, so nobody relies on coverage that was never claimed.

Editions by service

What each engagement adds to the spine

The four services produce four editions of the pack, each shaped by the work actually done — an audit documents findings; a migration documents the change and how to reverse it; identity and enterprise work document design, review and pilot results.

MCP Readiness Audit

£395

Evidence pack contents

  • Findings report (PDF and Markdown).
  • Remediation plan with priority ordering.
  • Client compatibility matrix with test conditions recorded.
  • Requirements, findings and acceptance traceability matrix.
  • Residual-risk register: what remains open, who owns it and what would close it.
  • Scope statement and exclusions as agreed at kickoff.
  • Methodology note describing what was and was not examined.

The pack is one of 5 deliverables listed for this service.

Full scope, exclusions and pricing

Stateless Migration Sprint

£1,950

Evidence pack contents

  • Scope statement and change-control record.
  • Architecture before/after summary.
  • Before/after state and authorisation data-flow summary.
  • Change log and pull-request review summary.
  • Test suite results and how to reproduce them.
  • Client verification record with test conditions.
  • Requirements, findings and acceptance traceability matrix.
  • Residual-risk register: what remains open, who owns it and what would close it.
  • Directory metadata and ownership readiness checklist — readiness assistance only, with no directory-acceptance promise.
  • Deployment runbook and documented rollback plan.

The pack is one of 5 deliverables listed for this service.

Full scope, exclusions and pricing

EMA/ID-JAG Design & Pilot

from £3,500

Evidence pack contents

  • Architecture document with identity-boundary diagrams.
  • State and authorisation data-flow summary.
  • Authorization design rationale (scopes, audiences, token-exchange flows).
  • Pilot test record with conditions and results.
  • Negative authorisation test record: wrong issuer, wrong audience, expiry, replay and insufficient permission.
  • Requirements, findings and acceptance traceability matrix.
  • Residual-risk register, including dependencies on your identity provider.
  • Security-review notes and resolved actions.
  • Hardening and rollout roadmap.

The pack is one of 5 deliverables listed for this service.

Full scope, exclusions and pricing

Enterprise MCP Pilot

£6,500

Evidence pack contents

  • Architecture and design documentation.
  • State and authorisation data-flow summary.
  • Security and identity review record.
  • Interoperability and acceptance test records with conditions.
  • Negative authorisation test record: wrong issuer, wrong audience, expiry, replay and insufficient permission.
  • Requirements, findings and acceptance traceability matrix.
  • Residual-risk register: what remains open, who owns it and what would close it.
  • Deployment runbook and rollback exercise record.
  • Directory metadata and ownership readiness checklist — readiness assistance only, with no directory-acceptance promise.
  • Operational guidance: logging, monitoring and incident basics for the pilot.
  • Procurement appendix: scope, dependencies, data handling, subprocessors and specialists, support boundaries and exclusions.

The pack is one of 8 deliverables listed for this service.

Full scope, exclusions and pricing

Honest boundaries

What deliverables are — and are not

Reviewers need to know exactly what weight a document can bear. So we state both sides plainly, in the pack itself and here.

Deliverables are

  • Evidence and documentation: what was examined or built, what was found or changed, and the reasoning behind every recommendation.
  • Reproducible test records: the named clients exercised, the exact conditions agreed in scope, and the recorded results — pass or fail.
  • Severity-ranked findings with the evidence for each, so your engineers can verify a finding rather than take it on trust.
  • Where implementation is in scope, runbooks and rollback plans written for your team to execute without us in the room.
  • A residual-risk register: what remains open at handover, why, who owns it, and what would close it.
  • A record of the access granted for the engagement, how credentials were handled, and confirmation of removal at handover.

Deliverables are not

  • Not a certification, accreditation or regulatory approval of any kind.
  • Not a compliance attestation — the pack gives your compliance function evidence to assess, not a conclusion to copy.
  • Not a security guarantee, and not a penetration test report — audits assess code, configuration and design, and say so explicitly.
  • Not a promise of compatibility with every MCP client — verification covers the clients named in the written scope, nothing broader.
  • Not a substitute for your own security and procurement review — it is built to make that review faster and better informed.

EcoCitizenz Ltd does not provide certification, compliance attestation or security guarantees, and says so rather than implying otherwise. The evidence pack gives your reviewers material to evaluate — it does not replace their judgement, and is not designed to.

Formats & handover

Delivered in formats your team already works in

A deliverable only counts if your team can find it, search it, version it and act on it a year later — without asking us.

PDF and Markdown, always both

Every written deliverable is supplied as a PDF for circulation to reviewers and as Markdown source, so it can live in your repository or wiki — searchable, diffable and yours to maintain.

Runbooks live in your repository

For implementation engagements, deployment runbooks and rollback plans are committed alongside the code they describe, so operational documentation versions with the system instead of drifting from it.

Walkthrough sessions, not a file drop

Deliverables are walked through live with your team — a findings walkthrough for the audit, handover sessions for implementation work — so questions are answered before the engagement closes.

Access removed, and confirmed

At handover, the access granted for the engagement is removed and the removal is confirmed to you. The security and access record in the evidence pack documents what was granted, when, and when it ended.

EcoCitizenz may use appropriately vetted specialists or subcontractors to support delivery. EcoCitizenz remains responsible for the agreed deliverables. Any specialist access to customer systems or confidential information will be disclosed and governed by the engagement terms.

Included, not sold separately

Included with every paid MCP service

Every paid engagement includes a 90-day ECZ-ID Business Passport experience: a machine-readable business profile for the emerging agent and machine economy, with a public Resolver page that people and software can read for themselves.

  1. Purchase

    Your order automatically starts account setup. There is nothing to apply for and no approval step — setup begins on its own.

  2. Activation

    When setup completes, your included Passport access activates automatically.

  3. 90-day access

    Your included 90-day period starts at activation. There is no automatic renewal and no automatic charge at day 91 — continuing is a separate decision you make.

  4. Resolver profile

    Your live ECZ-ID profile becomes available through Resolver after activation. You control what it says — optional profile information and bindings are managed by you through TrustOps.

What a reader can tell apart

The distinction below is the point of the page. Anything that blurred these four would be worse than publishing nothing.

Verified
Checked by ECZ-ID against a defined check. The check that was run is identifiable.
Self-declared
Supplied by the holder and published as their statement. Useful, and not independently checked.
Bound
Cryptographically or operationally tied to a control the holder demonstrated, such as a domain or an endpoint.
Referenced
Points at something maintained elsewhere. It is only ever as current as that source.

Who it is useful to

Insurers

A stable, resolvable reference for who you are and what you operate, instead of a PDF attached to an email thread.

Regulators and auditors

A dated, read-only projection they can check themselves, with the basis of each field visible.

Procurement

Somewhere to send a vendor-verification question that does not require you to be awake to answer it.

Customers

A way to confirm they are dealing with the business they think they are dealing with.

Partners

A durable identifier to reference in integrations and agreements rather than a marketing URL that changes.

Agents and software

A machine-readable profile an automated buyer can resolve and reason about, with each field's basis machine-distinguishable.

How useful any of that is depends on the information and bindings you maintain. A Resolver page does not prove compliance, and it does not make its holder the right choice — it lets a reader check specific things for themselves and see what has actually been checked.

90-day experience included with every paid engagement. See how Resolver proof works (external). See the technical documentation for ECZ-ID evidence-state definitions.

Choose the engagement — the evidence pack comes as standard

Every price is published, every scope is fixed in writing, and every engagement ends in the documentation described on this page. If you want to see how it is produced stage by stage, read the delivery method.

Your delivery schedule is confirmed during intake.