Give containment planners conditional gates, not a completed story

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Public activity · 30d

—Participating browsers

—Page views

—Reading sessions

—Exercise opens

Counts reflect browsers that allowed analytics. A reading session requires 30 seconds on a visible page. Browsers are not people.

Day 25 — Give containment planners conditional gates, not a completed story

Theory and mechanism. An investigation handoff should let the next decision owner distinguish observations, inference and proposed action without reopening every raw record. Include checkpoint/version, source-linked facts, quality gaps, competing mechanisms, pending requests, forbidden overclaim and the next authorized decision gate. Preserve the timeline/graph as evidence references; do not flatten their uncertainty into a single case-confidence score. P2 is a provisional allocation of response effort under this book's rubric, not a conclusion about compromise.

Worked contrast. “The attacker used batch-17, so disable svc-enroll” crosses four unproved boundaries: tag to actual job, job to validated session/request path, path to human actor, and hypothesis to authorized disruption. A defensible alternative reports the self-declared tag, missing joins, visible approval tension and unmeasured current state, then names the source-specific questions needed before a containment proposal. It may recommend preparation of bounded options; it cannot claim those options are approved or executed.

At 09:26, C11 and C12 are available but later containment cards are not. A useful handoff states that C12 supplements q-144 with a tag, not that it shows a second edit or validates a scheduler. It retains C09's acquisition gaps and C10's time/cache limits. It also notes C02's approximate symptom versus C05's 09:01 event as an unresolved timing tension. Do not solve that tension by inventing a clock correction or a hidden earlier edit.

Lesson table; scroll horizontally to read all columns →

Future condition, not a current result	Next permitted planning question	Gate still required
Authoritative state is wrong and a continuing harmful write path is supported	Which narrow reversible control could reduce that path's effect?	Service/identity/change owners decide scope, duration, operator, rollback and verification
Validated origin and applicable S42 approval explain the operation, with checked service outcome	Is a documented downgrade or non-security defect disposition justified?	Actual acceptance rule and owner review; remaining evidence gaps retained
Key source, owner or discriminator remains unavailable	What uncertainty and loss risk must be escalated now?	Authorized alternative or explicit blocked status; no automatic broad action

These branches are conditional. The first does not authorize a hold, revocation or account disablement; the second does not prove that all signals were false; the third does not establish safety. If a new source changes a claim, issue a new version with its actual receipt/release time and preserve the earlier rationale. A later observation can improve the next decision without retroactively validating an earlier unsupported assertion.

Decision and limits. The most useful conclusion may be that technical mechanism is still unresolved while an application record supports a reported edit and current impact remains unmeasured. Naming those separate confidence targets gives the next owner a tractable question. A shared account may prevent individual attribution even after mechanism is clarified. This limits blame, not the team's ability to investigate impact and prepare proportionate protection.

Practice. Complete EX025 as a 140–200-word 09:26 handoff plus a separate three-branch gate table. Include at least two unresolved explanations and a proposed checkpoint. Compare the worked answer, ensuring that no later card, completed follow-up, fictitious approval or human actor has entered the record. The end of Week 5 is an investigation handoff; the course and incident remain incomplete.

Continue studying — course Day 25: Previous: Day 24 · Week 5 index · Course index · Next: Week 6, Day 26.

Exercise for this lesson

EX025 — Professional handoff. Objective: transfer a source-limited investigation into gated response planning. Input: EX021–EX024 and the 09:26 record through C12. Write a 140–200-word handoff with priority/rationale, source-linked timeline, at least two unresolved explanations, acquisition/identifier gap, proposed requests, forbidden overclaim and a proposed review checkpoint. Outside the message add three conditional planning gates for harmful state, supported authorized explanation and unavailable evidence. No later card, collection receipt, approval or control execution may be invented. Rubric: 0 = unsupported actor/cause or action; 1 = accurate summary but missing alternatives, source limits or actionable gate; 2 = usable bounded message plus conditional gates preserving permission and checkpoint boundaries. Worked answer.

Practice the exercises

Open a prompt, write your response, then compare it with the worked answer. Five-choice practice appears where a reviewed question is available.

EX025

Open the prompt →Compare with the worked answer →

Opens in 30 days: — · browsers: —

Checking for a reviewed five-choice question…

Worked answers

EX025 — Model handoff. “CTN-IR-014 is P2 provisional at 09:26 because a reported enrollment symptom and C05 S42 edit merit urgent review, while the affected state and actor remain unknown. C03 reports s-77 at 08:58; C04's corrected runner event is approximately coincident; C09 supplies client runner-03 but lacks complete collection metadata. C05 reports q-144 at 09:01. C12's batch-17 is a self-reported tag, not a validated job run. C06's visible approval covers S40–S41; C11 suggests an addendum without providing one. C10 depicts an unavailable page, not authoritative S42 state. Scheduled-job error and unauthorized shared-account use remain plausible; display/cache behavior may affect the symptom. Ask the service owner for a bounded S42 state check and the job/application custodians for a q-144 run record and join semantics. Do not attribute a human or disable the shared account on this record. Reassess after authorized results or before further evidence loss.”

Additional worked reasoning (EX025 — Handoff model.): “At 09:26, CTN-IR-014 remains P2 provisional: C02 reports an S42 enrollment symptom and C05 records an S42 edit via q-144, but the current authoritative slot state and number affected remain unmeasured. C03 and C09 report session s-77, with C09 naming client runner-03; C04's corrected browser time is near the same minute, without a process-to-session key. C12 attaches an unverified batch-17 tag to q-144, not a proven job run. C06's visible task list covers S40/S41; C11 mentions a possible S42 addendum without producing it. C09 lacks complete source-copy provenance and C10 is a displayed symptom with unverified clock/cache. Ask the service owner for a bounded S42 state check and application/job custodians for a preserved q-144 run and validated join semantics. No human actor, approved control or collected follow-up is established. Review before further source loss or on verified harmful change.” A 140–200-word answer should preserve two live explanations, one explicit forbidden overclaim, scope/authority and next gate.

C5 join-audit extension — worked laboratory result.

C5|C03<->C09|session_id|s-77|match=True
C5|C05<->C12|request_id|q-144|match=True
C5|s-77_to_q-144|DIRECT_JOIN=NO

Two specified fields match within the supplied fictional rows; the direct session-to-request edge is absent. The printed DIRECT_JOIN=NO is an analyst annotation, not an independently calculated causal finding. EX022 earns full credit only if the student requests identifier-namespace validation, declines human attribution and treats a missing key as unknown rather than proof of unrelated events.

Week 5 Day 25 — worked planning handoff.

“At 09:26, CTN-IR-014 remains P2 provisional because a reported S42 symptom and edit warrant bounded review while current harm and cause remain unmeasured. C05 reports q-144 at 09:01; C12 adds a self-reported batch-17 tag, not a validated run. C03/C09 report s-77; C09 associates runner-03, but C04 supplies no process/session join and C05 has no session key. C02's approximate symptom time remains in tension with the edit time. C06 lists S40/S41; C11's possible S42 addendum is unprovided. C09's acquisition metadata and C10's clock/cache context remain incomplete. Scheduled error and outside-scope use remain unresolved; display divergence can coexist. Request approved S42 state/version and bounded job/request evidence, with a separate change-authority referral. Do not attribute a human or disable the account on these records. Propose review at 09:35 or earlier on verified harm, usable receipts or threatened source loss. No follow-up collection or control is claimed.”

Outside the message, record three gates: (1) verified wrong state plus continuing harmful path → seek bounded control options and actual owner approval, operator/rollback/verification; (2) validated origin plus applicable scope and checked service outcome → seek an owner-led disposition review, retaining residual gaps; (3) unavailable source/owner → escalate the blocked decision and preservation risk, with no inferred safety or authority. These are future branches, not later case facts. The message's word limit excludes this gate table/annotation.