03:12. Structure fire.
Persons reported.
The clearest way to understand Warden is to watch one incident run. Here is the same fire with drone overwatch in the loop — and, alongside each beat, the line it writes to the tamper-evident record.
This is an illustrative, synthetic scenario — no real incident, address or person. It's written to show how the pieces fit in time: the flight, the picture, the human decisions, and the record each one leaves. Every timestamp and hazard here is invented to make the sequence legible.
01 The incident, in real time
Watch the record form on the right of every decision.
The 999 call lands
Control categorises it: structure fire, persons reported. An incident is opened and the record begins — before anything flies, before anyone commits.
Record #01 · INCIDENT OPENEDA human authorises the flight
The partner's aircraft is ready to launch. A named commander — not the software — authorises overwatch, and the necessity and proportionality of that decision are captured with it.
Record #02 · FLIGHT AUTHORISED · ◆ humanEyes on, before the crew
The drone reaches the scene ahead of the appliances. Thermal overwatch is live: two heat signatures on the first floor, a hotspot building at the rear. Live-only — nothing is stored.
Record #03 · OVERWATCH FEED LIVEA hazard, called early
The commander spots a gas cylinder at the rear and flags it to the incident commander — before a single firefighter is anywhere near it.
Record #04 · HAZARD FLAGGEDThe first appliance arrives to a picture
Not a blank street in the dark. Where the people are, where the fire is travelling, and where not to send a crew — minutes of situational awareness that simply didn't exist before.
Stand down, and sanitise
Incident closed. The live feed is already gone; any footage a deployment opted to retain is purged on its schedule — and the deletion is itself written to the record.
Record #05 · MEDIA PURGEDThe record is sealed
Closed and immutable. If this deployment is ever reviewed — by the service, the ICO or a court — the account of who authorised what, and why, answers for itself.
Record #06 · RECORD SEALED · ✓ verified02 What changed
Same fire. A different first ten minutes.
Before A blank street
Crews arrive without knowing where the people or the hazards are. The picture is built on the ground, in smoke, under time pressure — and no one can later prove exactly what was decided, or when.
After A scene already read
Thermal overwatch hands the commander the layout before the first boots are down — lawfully, with no facial recognition, nothing stored by default, and every decision on a record that can't be quietly rewritten.
03 The whole system, on one picture
What the drone sends in, what the commander controls, and how every decision becomes a signed, sealed entry no one can quietly rewrite.
One-way by design
Warden sits downstream of the ground station and physically cannot send flight commands. Adding it introduces no airworthiness or liability surface to the operator’s aircraft.
Live-only by default
By default the thermal feed is live-only — no imagery is stored. Any opt-in recording is retention-bound, and its deletion is itself written to the record as a signed event.
Provably unaltered
Every action is signed into an append-only HMAC hash chain. Edits, deletes and un-seals are rejected at the database, and anyone can recompute the chain to prove it was never altered.
Diagram illustrates a design concept — not a deployed system.
The console runs this exact sequence — the feed, the human authorisation, the ledger forming and a live tamper test. Open the live demo →