Chapter 35 — Design studio II | Engineering Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 35 — Design studio II

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 Problem"]
  N2["35.2 Copy"]
  N3["35.3 Review"]
  N4["35.2b Accessibility of honesty"]
  N5["35.3b Export as the source of truth"]
  N6["35.1b Narrative exports"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 Problem"]
  N2["35.2 Copy"]
  N3["35.3 Review"]
  N4["35.2b Accessibility of honesty"]
  N5["35.3b Export as the source of truth"]
  N6["35.1b Narrative exports"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX103"]

[Learning outcomes]
    |
    v
[35.1 Problem]
    |
    v
[35.2 Copy]
    |
    v
[35.3 Review]
    |
    v
[35.2b Accessibility of honesty]
    |
    v
[35.3b Export as the source of truth]
    |
    v
[35.1b Narrative exports]
    |
    v
[Practice note]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) redesign PulseMap's coverage UI against under-claim principles; (2) defend the design in a review; (3) produce UI copy that refuses empty scores.

35.1 Problem

Stakeholders want a big green percentage. Design a UI that shows planned/observed/not-seen and refuses a single "security score".

Studio II asks for honest coverage copy people can actually read under time pressure. Empty scores and vanity badges are the enemy. Sam supplies a bad first draft on purpose so teams practise deleting claims. Deleting claims is graded as progress when the claim lacked evidence. Progress on deletion is shown in the gallery beside teams that only rewrote adjectives.

35.2 Copy

"71% of planned techniques observed — not a residual-risk score." Link to Albrecht & Jensen in the help text. Button: export denominator.

Words like secure and fully covered are banned unless a formula sits beside them. Plain language beats jargon when managers skim. Sam's rubric scores honesty above clever metaphors. Banned words such as "secure" and "fully covered" trigger a CI lint on UI copy strings. The lint prints the token and path; in studio, teams must replace them with a fraction and a caveat in the style of "71% of planned techniques observed — not a residual-risk score" before the UI can merge.

35.3 Review

Reviewers try to force a red/yellow/green risk badge; studio must hold the line with measurement chapter rules.

Synthetic case — Riverstone Transit. Studio II killed the badge; the dashboard now lists the two planned-not-seen techniques by id.

Readers from outside the squad mark every sentence they cannot verify. Unverifiable sentences are cut or given formulas. Sam treats reader marks as merge blockers equal to failed tests, and he keeps the marked copy in the dossier so the honesty pass leaves a trail.

35.4 Errors and limits

Dark patterns ("just for executives") reintroduce empty scores — reject in CODEOWNERS for UI.

Beautiful prose that hides a missing denominator fails the studio. Honesty is a safety property of the UI. Sam's facilitators may freeze a team that argues for a badge without a planned set, and the freeze lasts until the badge is removed or the formula is written beside it. Frozen teams may continue drafting formulas but cannot present until a facilitator signs that the planned/observed/not-seen fraction is visible without hovering, which is the same rule that blocks tooltip-only caveats in the accessibility checklist.

35.2b Accessibility of honesty

Under-claiming metrics must still be readable: large type for the fraction, plain language for the caveat, keyboard access to the denominator export. Hiding the caveat in a tooltip reintroduces the empty-score problem for anyone who does not hover.

Screen readers must hear the formula, not only see a colour. Colour-only danger cues fail accessibility and honesty together. Sam tests exports with a text-only browser in the studio checklist. Text-only browser results are pasted into the studio notes beside the UI screenshot. If the screen reader hears only "green" while the screenshot shows 5/7, the copy fails until the fraction is in the accessible text.

35.3b Export as the source of truth

If the UI and the CSV export disagree, the export wins for the report. Build exports first; treat UI as a view. That removes arguments about what "71%" meant in a screenshot.

Reviewers verify numbers from the file. Sam's release checklist diffs UI captions against export headers. Tags cannot be cut while those diffs are red, which keeps the CSV export — the source of truth for the 71% figure — aligned with what the UI claims. A screenshot in a report must carry the export file name and hash it was taken from.

35.1b Narrative exports

Alongside CSV, export a short Markdown narrative generated from the same query as the UI ("planned 7, observed 5, not seen: T1059, T1021"). Narratives paste into reports without screenshot ambiguity.

Short narratives that restate the formula help non-engineers without replacing the numbers. Sam limits narratives to five lines so they cannot smuggle new claims. Line limits are enforced by a linter on the narrative export template. When a narrative runs past five lines, the export job writes a stub that states which lines must shrink — usually a smuggled severity adjective — instead of emitting a report-ready Markdown file.

Practice note

User research for PulseMap includes one task: explain this number to a CFO without saying we are safe. If users cannot, the UI copy has failed regardless of visual design. Record those sessions (with consent) as qualitative evidence next to the quantitative coverage formula.

35.4b Testing copy with real readers

Sam asks two Riverstone Transit managers and one operator, none of whom were involved in the design, to read the report summary aloud and explain what it means. Where they hesitate or misread a severity, the wording changes; reading tests catch ambiguity that reviewers who wrote the text cannot see.

Real readers find jargon and missing denominators faster than authors. Sam books two managers and one operator for each studio's copy test and files their notes with the ADR. Notes may omit names at a manager's request, but each issue still carries an id such as COPY-12 so the fix that clarified "not a residual-risk score" can be traced without a blame trail.

Exercises

EX103 — Copy. Write the subtitle under the coverage number. Rubric: 3 = denies residual-risk reading; 2 = weak caveat; 1 = none; 0 = implies safety.
EX104 — Badge refusal. One sentence refusing a RAG badge. Rubric: 3 = clear + alternative; 2 = refuse only; 1 = accepts; 0 = none.
EX105 — Export. What columns does denominator export include? Rubric: 3 = technique id, planned, observed, notes; 2 = partial; 1 = just %; 0 = none.

Synthesis

UI that teaches the metric, not a traffic light of vibes.

Continue studying — chapter 35 of 50

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →