IBM Guardium Data Protection — Protect

Screen: Create New Rule · Evidence: E08

When the required Rule name field is empty and user clicks OK, the button is silently disabled. No inline error message appears, no field highlighting, no indication of what is needed. Only the greyed-out OK button signals failure. Violates WCAG 3.3.1 — error must be identified and described in text.

Recommendation: Display inline error message on field blur or submit attempt: "Rule name is required." Use Carbon's form field error pattern with error icon and red border.

Screen: All screens · Evidence: E03, E04

document.title remains "IBM Guardium (cm01)" throughout all navigation. Screen reader users and users relying on browser history cannot determine their current location within the product.

Recommendation: Update document.title dynamically on navigation events: e.g., "Security Policies — IBM Guardium", "Create New Policy — IBM Guardium".

Screen: Create New Policy form · Evidence: E05

DOM inspection: all three policy type radio buttons share value="on". Labels correctly associated, but non-unique values break standard radio semantics for AT users who depend on value announcements.

Recommendation: Set unique value attributes: value="data-security", value="session-level", value="advanced-session".

Screen: Create New Rule → Rule criteria · Evidence: E08

Each criteria row (parameter name, operator, value) is a logical triplet but not wrapped in a fieldset/legend or ARIA group role. Screen reader users cannot determine which value field belongs to which parameter name.

Recommendation: Wrap each row in role="group" with aria-label like "Session criteria row 1: parameter, operator, value".

Screen: All screens · Evidence: E04, E05, E06

Guardium uses a legacy DOJO framework (dijit_form, idx_form element IDs). Carbon React / Web Components are not in use. Carbon 2x grid, type tokens, color tokens, and component patterns are not implemented. Carbon components and patterns both score Level 0.

Working well: Internal consistency within the DOJO system. IBM Plex font appears present. Blue/neutral color approach is IBM-aligned.

Recommendation: Strategic migration to Carbon React or Web Components. Tactical: align palette and spacing to IBM Design Language within current framework. Requires Carbon visual design reviewer for full assessment.

Screen: Security Policies list · Evidence: E04

Primary action toolbar (New, Edit, Copy, Remove, Refresh, Comment, Download) uses icon-only buttons without persistent text. ARIA labels are present in the AT tree. However, visually no text labels appear. Carbon standard requires icons not appear without text except in global header or icon buttons with tooltips.

Recommendation: Add text labels to primary actions (New, Edit) or ensure Carbon-compliant tooltips are consistently attached.

Screen: Create New Policy / Create New Rule · Evidence: E06

Form sections use plain 'Expand'/'Collapse' text links instead of Carbon Accordion. Keyboard accessible, but the pattern does not align with Carbon interaction affordances.

Recommendation: Migrate to Carbon Accordion when re-platforming to Carbon React.

Screen: Security Policies list / Create New Policy · Evidence: E04, E05

For the Gate Keeper / DBA persona, creating a data security policy is a high-stakes task requiring prior knowledge. The flow offers no guidance on policy types, rule types, or how to leverage templates. No empty-state guidance, no recommended starting path, no inline explanations.

Working well: 74 policies available including compliance templates. Help icon present. Progressive disclosure reduces initial cognitive load.

Recommendation: Add empty-state guidance: "Start with a template to configure your first data security policy." Add tooltip/helper text for policy types and rule types. Design a short guided path for new Gate Keeper users.