Chapter 25 — Design studio I | Engineering Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 25 — Design studio I

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 Studio problem"]
  N2["25.2 Trade-offs"]
  N3["25.3 Decision record"]
  N4["25.2b Sketch quality bar"]
  N5["25.3b Facilitator role"]
  N6["25.1b Constraint cards"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 Studio problem"]
  N2["25.2 Trade-offs"]
  N3["25.3 Decision record"]
  N4["25.2b Sketch quality bar"]
  N5["25.3b Facilitator role"]
  N6["25.1b Constraint cards"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 Studio problem]
    |
    v
[25.2 Trade-offs]
    |
    v
[25.3 Decision record]
    |
    v
[25.2b Sketch quality bar]
    |
    v
[25.3b Facilitator role]
    |
    v
[25.1b Constraint cards]
    |
    v
[Practice note]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) sketch TrackScope's allow/deny pipeline; (2) justify trade-offs in a short design review; (3) produce a one-page decision record.

25.1 Studio problem

Design the pipeline: input action → load ScopeVersion → evaluate predicate → emit event → return decision. Competitors: embed policy in code vs data file; sync vs async events.

The pipeline sketch forces students to name where policy loads and where events go. Embed-versus-file and sync-versus-async are real Riverstone debates. Sam supplies a blank ADR template so the studio ends with writing, not only a whiteboard photo. Teams submit the ADR before the gallery walk; photos alone are archived as informal notes and never replace the written decision for grading or for operations.

25.2 Trade-offs

Policy-as-data lets ROE updates ship without redeploying binaries but needs signature verification. Async events scale but can reorder; for deny-list hits, prefer sync alert.

Unsigned policy-as-data is a tampering gift; signatures cost key management. Async deny alerts that reorder can page late; sync costs latency. Sam's rubric scores whether the team named both sides before choosing, including one sentence that states the rejected option's strongest argument in the writers' own words — a step that often exposes a choice made on familiarity alone.

25.3 Decision record

One page: context, options, decision, consequences, date, owners. Store next to the code.

Synthetic case — Riverstone Transit. Studio chose policy-as-signed-JSON, sync path for denies, async bulk for allows. ADR-004 captures it.

One page beats a slide deck nobody diffs. Storing it next to code means reviewers see it in the same pull request. Sam links the ADR from the README of the service it affects. README links use the ADR filename, so a rename without an update breaks the doc build and gets noticed.

25.4 Errors and limits

Studios that skip safety requirements produce pretty diagrams that fail open.

Pretty boxes that omit fail-closed paths fail the studio even if the arrows are neat. Safety requirements are checked before aesthetics. Sam's facilitators are briefed to ask the missing-policy question early, and a sketch that cannot answer it is returned for revision rather than polished. More than two returns in one studio triggers a short lesson on fail-closed paths before the next sketch is attempted. The lesson walks the missing-policy DENY path on the whiteboard until every team can point to where TrackScope returns deny when the ScopeVersion file does not load.

25.2b Sketch quality bar

A studio sketch must name trust boundaries, data stores, and the fail-closed path in writing — not only boxes and arrows. If a reviewer cannot point to where DENY happens when policy is missing, the sketch is incomplete. Ten minutes of labelling beats an hour of aesthetic layout.

Written fail-closed paths survive when arrows are redrawn. Trust boundaries and stores must be labelled for a reviewer to attack the design. Ten minutes of labels prevent hour-long layout bikesheds. Sam rejects unlabelled sketches at the door of the gallery.

25.3b Facilitator role

Studios need a facilitator who watches for safety omissions and empty scores while teams debate latency. The facilitator can pause the room with a single question: "Where do we DENY if policy is missing?" If nobody can answer, architecture is not ready.

Someone has to defend safety while the room optimises latency. The pause question resets the debate to DENY paths. Sam rotates facilitators so every student practises the role. After each studio the facilitator writes three sentences on what the room almost missed, filed with the ADRs.

25.1b Constraint cards

Hand each studio team physical or digital constraint cards: residency, two-engineer ops, fail-closed, no empty scores. Designs that violate a card are rejected before aesthetic debate starts. Cards rotate across studios so teams practice different constraints.

Physical cards make residency and fail-closed hard to forget under time pressure. Rejecting violators before aesthetics saves the afternoon. Rotating cards builds fluency across constraint sets. Sam prints the cards on different colours for quick room scans. Digital card decks shuffle automatically so neighbouring teams rarely share the same constraint order.

Practice note

Each studio ends with a gallery: teams post ADR drafts and other teams try to find a fail-open path in five minutes. Finding one is success for the reviewers, not failure for the authors — provided the path is fixed before the next milestone. The competitive energy goes into safety hunting rather than slide polish, which is the point of Design Studio I and II in this programme.

Exercises

EX073 — Options. Name two options for policy delivery and one risk each. Rubric: 3 = two options + risks; 2 = options only; 1 = one; 0 = none.
EX074 — ADR. Write the Decision line for sync deny alerts. Rubric: 3 = clear decision + why; 2 = decision only; 1 = vague; 0 = none.
EX075 — Review ask. List three questions a reviewer must ask. Rubric: 3 = fail-closed, authn of policy, performance under flood; 2 = two; 1 = one; 0 = none.

Synthesis

Studio work ends in a recorded decision, not a vibe.

Continue studying — chapter 25 of 50

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →