The AI Incident & Anomaly Log is the primary tracking console for AI-related security events, policy violations, and operational anomalies across the environment. It is part of the AI Governance suite and is designed to be reviewed at each AI Steering Committee meeting.

The console is a single self-contained HTML file. It runs in the browser, requires no backend server or build process, and in Phase 1 reads from and writes to a SharePoint list using the user's existing browser session for authentication.

The console has two operating modes controlled by a single flag in the script. Switching from demo to live requires no UI changes — only the data layer swaps.

Four cards sit across the top of the console. They calculate against the full dataset regardless of any active table filters and update automatically when new incidents are logged.

Three charts sit below the stat cards. All three calculate against the full dataset and do not respond to table filters — they always show the complete picture.

The Log New Incident form sits directly above the register table. The Date field auto-fills to today on page load. Required fields are Date, Category, Severity, and Description — Owner and Resolution Notes can be filled in later.

• 1
  Confirm or adjust the Date.Defaults to today. Change it if logging a past incident.
• 2
  Select a Category.Pick the type that best fits. See Section 10 for full category definitions. If nothing fits, use Other and explain in the Description field.
• 3
  Select a Severity.High for confirmed data exposure, active bypass, unauthorized production changes, or any client impact. Medium for policy violations without confirmed exposure. Low for benign anomalies or near-misses. See Section 11 for the full matrix.
• 4
  Enter the Owner.The engineer or lead responsible for driving this to resolution. Can be left blank at log time and assigned during triage.
• 5
  Write a factual one-line Description.What happened, where, and which AI tool or workflow was involved. No speculation — stick to what is confirmed at time of logging.
• 6
  Add initial Resolution Notes if available.Paste any immediate containment steps already taken. This can be left blank and updated later directly in SharePoint once Phase 1 is live.
• 7
  Click LOG INCIDENT.The record appears at the top of the register immediately. All four stat cards and all three charts update. A green confirmation toast appears in the bottom-right corner with the assigned Incident ID.

The toolbar above the register table has four controls that work simultaneously. Filtering is instant — no button press required. The export always reflects the current filtered view.

Clicking any column header sorts by that column. Clicking the same header again reverses direction. The sorted column header is highlighted in cyan.

Clicking any row in the register opens the Incident Detail modal. The modal shows all fields for that record in full — Description and Resolution Notes are not truncated as they are in the table view.

• 1
  Click any rowin the register. The modal appears centered on screen.
• 2
  Review all fieldsincluding the full Resolution Notes block at the bottom of the modal panel.
• 3
  Close by clicking ✕in the top-right of the modal, or by clicking anywhere outside the modal panel.

The ↓ CSV button in the table toolbar exports the rows currently visible after all active filters are applied. The file is generated entirely in the browser — no server call is made. The filename includes today's date automatically.

• 1
  Apply filters if needed.The export reflects exactly what is shown in the table. Set no filters to export the full register.
• 2
  Click ↓ CSV.File downloads as AI-Incident-Log-YYYY-MM-DD.csv immediately.
• 3
  Open in Excelfor committee reporting, pivot analysis, or pasting into a quarterly review document.

These are the allowed values for the Category field in both the console form and the SharePoint list. Use the most specific category that fits. If none fit, use Other and explain in the Description.

Phase 0 (demo) has no prerequisites — open the file in any browser and it runs. Phase 1 (live SharePoint) requires the following before you start.

The console is a single self-contained HTML file. No dependencies to install, no build step, no backend server. Upload it and it runs.

• 1
  Navigate to your document libraryon the destination SharePoint site.
• 2
  Upload ai-incident-log.htmlusing the Upload button or drag-and-drop directly into the library.
• 3
  Click the file nameto open it. SharePoint renders the HTML inline. You should see the console in demo mode with the orange DEMO MODE badge top-right.
• 4
  Copy the URL from the address bar.This is the link you will share with users: https://TENANT.sharepoint.com/sites/SITE/Shared%20Documents/ai-incident-log.html

The console reads and writes to a SharePoint list named AI Incident Log on the same site. The list name must match exactly — the REST call references it by title.

• 1
  Go to Site Contents.Gear icon → Site Contents, or navigate to /sites/SITENAME/_layouts/15/viewlsts.aspx
• 2
  Click + New → List → Blank list.Name it exactly: AI Incident Log. No description needed. Click Create.
• 3
  Rename the default Title column to Description.Click the Title column header → Column Settings → Rename → type Description → Save.
• 4
  Add the following columnsusing + Add Column in the list view:

Open ai-incident-log.html in a text editor. Near the top of the <script> section, find the SP_CONFIG block:

• 1
  Replace siteUrlwith your actual SharePoint site URL. Example: https://cyberadvisors.sharepoint.com/sites/AIHub. No trailing slash. No page path after the site name.
• 2
  Confirm listNamematches the exact name you gave the list in C3 — including spaces and capitalization. If you named it differently, update this value.
• 3
  Leave demoMode: true for now.You will flip this to false in C5 after the REST code blocks are uncommented and the list is confirmed to exist.
• 4
  Save the fileas .html. Do not allow your editor to save it as .txt or any other format.

With the list created and SP_CONFIG updated, activate the SharePoint connection by making three changes in the script and re-uploading the file. All changes are commented inline and clearly marked.

Run through each item below after going live. Do not share the console URL with users until all items pass.

• ✓
  SP badge is green. Top-right shows solid green dot and reads SP CONNECTED. If still orange, demoMode was not set to false or the file was not re-uploaded.
• ✓
  No JS errors on load. Open browser console (F12 → Console tab). No errors should be present. Stat cards show real numbers — zeros are fine for an empty list, dashes (—) mean the fetch failed.
• ✓
  Log a test incident. Fill the form, submit. Confirm the toast appears, the row appears in the table, and the stat cards update. Then open the SharePoint list directly and confirm the item is there.
• ✓
  Open the detail modal. Click the test row. Confirm all fields display correctly including Description and Resolution Notes.
• ✓
  Test all filters. Apply severity, status, and category filters individually and together. Confirm they narrow the table correctly and that clearing them restores all rows.
• ✓
  Test CSV export. Click ↓ CSV. Confirm the file downloads with correct columns and the test row is present.
• ✓
  Test as a non-owner user. Have a technician without Site Owner permissions open the page and log an incident. If they get a 403 on the POST, check list permissions — the user needs at least Contribute. The list inherits from the site by default.
• ✓
  Delete the test incident. Open the SharePoint list directly and delete the test row. Refresh the console and confirm it is gone. The list is the source of truth.