Why the order matters
If a model can choose the next action during a run, nobody can tell you in advance what will touch your systems — the scope becomes whatever the model inferred. Putting correlation strictly after collection means the authorisation you signed describes exactly what happened, and the check log proves it.
What you can audit
- The authorised scope, as signed
- The complete list of checks executed, with timestamps
- The template version used per system type
- Which findings came from correlation and which from a reviewer
- Where your data is held and when it is deleted