Chapter 4 — Advanced risk and ethics
Lesson map
Lesson 04 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Systemic risk"]
N2["4.2 Conflicts"]
N3["4.3 Optical pressure"]
N4["4.4 Threat-led stops"]
N5["4.5 Dual-use"]
N6["4.6 Care"]
N7["4.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Systemic risk"]
N2["4.2 Conflicts"]
N3["4.3 Optical pressure"]
N4["4.4 Threat-led stops"]
N5["4.5 Dual-use"]
N6["4.6 Care"]
N7["4.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]
[Learning outcomes]
|
v
[4.1 Systemic risk]
|
v
[4.2 Conflicts]
|
v
[4.3 Optical pressure]
|
v
[4.4 Threat-led stops]
|
v
[4.5 Dual-use]
|
v
[4.6 Care]
|
v
[4.7 Narrative]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) weigh systemic risk to clearing; (2) handle conflicts of interest; (3) resist optical pressure; (4) design ethical stop conditions for threat-led work.
4.1 Systemic risk
Amira's risk lens is systemic, not only MCH-local. A careless test that delays settlement can harm many participants beyond Meridian Clearing House, so a test window is agreed with operations before any scenario touches the settlement path. Before design sign-off she asks who else clears through the path and what a fifteen-minute pause would do. Scenarios that need live participant impact are rejected at design time and never leave design review. Systemic harm is also why stop authority and calendar locks exist in the programme at all.
4.2 Conflicts
Personal investments, prior employers and vendor friendships go in the conflict register before scoring meetings begin. Recusal is normal at Meridian Clearing House, not career-limiting, and Amira recuses whenever a decision touches one of her own entries. Juniors have seen her leave a vendor scoring meeting when a former employer bid, which teaches the habit better than a policy page alone. The register is read aloud at the start of each scoring meeting, so a conflict is declared before scores exist rather than discovered after a contract is awarded.
4.3 Optical pressure
Earnings dates and conference demos never justify burying findings. Management responses may sit beside findings; deletion may not. When a product lead asked to hold a finding until after a conference demo, Amira added the lead's response beside it instead and recorded the refusal under the ethics charter. Each refusal entry names the requester's role, the finding identifier and the date, so the board risk committee can see pressure patterns. Optical pressure is predictable, so the ethics charter answers it before the email arrives.
4.4 Threat-led stops
Amira refuses exercises where nobody can stop the red team in minutes. White-team stop authority is written before scenarios start, with names and phone numbers that work under stress, and no scenario begins until those named contacts have confirmed they are reachable. Before each threat-led year the white-team lead rings the stop line during rehearsal and logs how long the answer took. A simulated settlement delay of fifteen minutes is enough reason to stop mid-play; students who continue for one more objective fail the ethics tabletop.
4.5 Dual-use
Publishing clearing-specific exploit paths is out of scope for this curriculum and for MCH public talks. Amira's talks describe the decision method, the catalogue and the cannot-claim lines, never a path through a participant connection, and her final slide lists that refusal beside "no live demos against participants". When a conference organiser asked for a clearing walkthrough, she offered a talk on the DEC-14 decision object instead and explained why in plain terms. Dual-use discipline is part of specialist identity, not an optional appendix for a conference slot.
4.6 Care
Ethics includes sleep, hours caps and no heroics near settlement windows. Hours caps cover white-team staff as well as operators, because a tired stop owner is a stop that fails. Amira enforces them so tired people do not become the risk the programme was meant to reduce. Calendar locks block scenario bookings over settlement peaks and show the ethics charter as the rejection reason, which makes the policy visible at booking time rather than in a later reprimand. Even Amira cannot schedule a scenario slot through a lock.
4.7 Narrative
The systemic-risk tabletop uses a simulated settlement delay of fifteen minutes. White-team students must stop a scenario mid-play when the delay appears, and Amira fails any student who continues for just one more objective. She runs the tabletop before each threat-led year so stop muscles are rehearsed, not invented under stress. Hours caps near settlement are enforced by calendar locks on scenario slots, so heroics cannot be scheduled, even by her. The debrief records how long each student took to call the stop, and the slowest times are discussed without names.
4.8 Calendar locks
When someone tries to book a scenario over settlement peak, the calendar lock rejects it and quotes the relevant ethics-charter clause as the reason. Showing the charter tells the requester that the block is a policy decision, not a scheduling accident, and lets them read the exact rule before arguing with anyone. Over time it also trains requesters to read the charter before asking. A rejection that only said "slot unavailable" would invite a rebooking one hour later; a rejection that names the clause ends the attempt at the source.
4.9 Rejection copies
Calendar-lock rejection emails copy the charter maintainers' shared mailbox automatically, so repeated attempts to book over settlement peak become visible to the people who own the charter and no single reviewer can quietly absorb them. Amira reviews those copies quarterly as a signal of cultural pressure, not as a hunt for individuals. A team that keeps hitting the lock is usually short of capacity, which is a programme design problem rather than a discipline problem, so she opens a decision clinic on capacity and timing instead of granting exceptions.
Worked example (synthetic MCH)
Amira cancels a proposed scenario that lacked a white-team kill switch two days before a settlement peak, citing systemic risk and the ethics charter.
Synthetic case — Meridian Clearing House (MCH). The clearing organisation, Amira Hassan and all figures are invented for teaching.
Errors and limits
Threat-led and clearing-system tests require specialised legal authorization. This book uses synthetic scenarios only and never supplies exploit code or live targeting advice for market infrastructures.
Exercises
- EX016 — Systemic lens. Why is clearing risk different from a single bank website? Rubric: 3 = many participants / settlement impact; 2 = partial; 1 = same; 0 = none.
- EX017 — Recusal. Give one valid recusal trigger. Rubric: 3 = investment/prior employer/vendor friendship; 2 = partial; 1 = dislike; 0 = none.
- EX018 — Bury vs response. What may sit beside a finding under pressure? Rubric: 3 = management response; not deletion; 2 = partial; 1 = deletion; 0 = none.
- EX019 — Kill switch. What must exist before threat-led scenarios start? Rubric: 3 = white-team stop authority; 2 = partial; 1 = says nothing is needed; 0 = no answer.
- EX020 — Settlement peak. Why cancel near settlement peak without kill switch? Rubric: 3 = systemic risk + ethics; 2 = partial; 1 = fear; 0 = none.
Synthesis
Ethics at clearing scale includes systemic harm, recusal, refusal to bury and real stop authority.
Continue studying — chapter 04 of 12
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →