A VALIDATION-FIRST FRAMEWORK FOR EVALUATING CYBER-INTELLIGENCE GOVERNANCE: DECISION ADMISSIBILITY, FAIR COMPARISONS, AND AN INDONESIAN APPLICATION PROTOCOL

Abstract

Comparisons of cyber-intelligence governance can produce precise numerical rankings without establishing that the compared workflows represent credible institutional alternatives. This methodological study develops a validation-first framework for comparing hierarchical, participant-governed, administrative-broker, and dual-hub arrangements. It separates communication topology from decision protocol, operational capability, resource allocation, and failure exposure. An action-specific admissibility rule distinguishes accumulated evidence from mandatory information, current authority, and release-time validity. Four analytical diagnostics address compensatory evidence thresholds, architecture–protocol confounding, finite-campaign queue overload, and incomplete accounting of redundancy. A deterministic verification implementation enumerates all 64 evidence subsets in a six-class example, checks a threshold condition across 101 thresholds, and reproduces exact queueing and recovery identities. At the inherited 0.72 threshold, eight logical states qualify; four lack an item required by the explicitly illustrative action specification. These counts establish a logical counterexample, not an operational error rate. An Indonesian application protocol translates the framework into observable process records, practitioner challenge, calibration, and held-out exercise evaluation. No operational incidents, practitioner responses, measured policy effects, or new architecture-performance rankings are reported. The contribution is an auditable specification of what must remain comparable, what must be measured, and what evidence is needed before simulation outputs can support institutional recommendations.