OCCAM
Control rationalizer: duplicate clusters, coverage gaps, and control theatre, with an impact preview before the prune.
The problem
Control libraries grow the way attics fill. Every audit finding adds a control, every new regulation adds a control, every incident adds two, and nothing is ever retired because nobody can prove it is safe to. A mid-tier bank easily carries hundreds of controls where dozens are load-bearing, with near-duplicates under different names, controls that exist only as attestation theatre, and genuine coverage gaps hidden behind the sheer volume. The library is too big to read and too risky to prune, so it just gets bigger.
What it does
OCCAM rationalizes the library with the razor its name implies. Deterministic semantic analysis runs across a three-hundred-control synthetic library and clusters the near-duplicates: same intent, same risk, different wording, different owners. Coverage analysis maps the library against the risk taxonomy and shows where four controls crowd one risk while a neighboring risk has none. Control-theatre heuristics flag the patterns practitioners recognize: controls whose evidence is the assertion of the control, review steps with no rejection path, attestations nobody could fail.
Every rationalization candidate comes with an impact preview: what the merged control would cover, which risks and obligations the retired ones touched, and what would need re-mapping before anything is switched off. The prune becomes a governed decision instead of a leap.
Why it matters
The control library is the denominator of half the second line's work: assessments assess it, testing samples it, issues map to it, regulatory change matches against it. A bloated denominator taxes everything downstream and hides the gaps that matter. Rationalization is not housekeeping; it is how the control environment becomes legible enough to defend.
Honest framing
OCCAM is a working prototype and a blueprint, not a product. It runs in the browser on a synthetic demo tenant with a fictional control library and deterministic demo analysis. Open it, read a duplicate cluster, and see whether the impact preview changes your appetite for the prune. That is what it is for.