◇ OpenCyber Academy
Professional · Chapter 11 · English

Chapter 11 — Supervised laboratory

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Supervised laboratory

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Purpose of the check"]
  N2["Lab — Treasury proposal policy check"]
  N3["11.2 Interpreting the output"]
  N4["11.3 Deciding next steps"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Purpose of the check"]
  N2["Lab — Treasury proposal policy check"]
  N3["11.2 Interpreting the output"]
  N4["11.3 Deciding next steps"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX051"]
[Learning outcomes]
    |
    v
[11.1 Purpose of the check]
    |
    v
[Lab — Treasury proposal policy check]
    |
    v
[11.2 Interpreting the output]
    |
    v
[11.3 Deciding next steps]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) check treasury proposals against policy; (2) interpret readiness results; (3) decide what must happen before signing.

11.1 Purpose of the check

Before signers approve any proposal, Bayview's policy requires: every signer on the list is current, the destination is on the allow-list, ordinary proposals have two current approvals and proposals of 2,500 units or more have three. Marcus writes a read-only script that reads a synthetic signer list and pending proposals and reports which are ready and which are not, with reasons. In the supervised lab, Ms Holm reviews his script and its output. It uses only Python's standard library and synthetic data, and it cannot sign or send anything.

Lab — Treasury proposal policy check

"""Check pending treasury proposals against a written policy (synthetic, read-only)."""
SIGNERS = {"finance-lead": "active", "director": "active", "trustee-a": "active", "former-cfo": "left"}
THRESHOLD = 2
# proposal id, amount, destination on allow-list?, approvals so far
PROPOSALS = [("P-31", 800, True, ["finance-lead"]), ("P-32", 4200, True, ["director", "trustee-a"]),
             ("P-33", 950, False, ["finance-lead", "former-cfo"])]
LARGE = 2500   # policy: large payments need 3 approvals

def main():
    gone = [s for s, st in SIGNERS.items() if st != "active"]
    if gone:
        print(f"signer list includes departed: {', '.join(gone)}")
    for pid, amt, allowed, appr in PROPOSALS:
        valid = [a for a in appr if SIGNERS.get(a) == "active"]
        need = 3 if amt >= LARGE else THRESHOLD
        notes = []
        if not allowed:
            notes.append("destination not on allow-list")
        if len(valid) < need:
            notes.append(f"active approvals {len(valid)}/{need}")
        print(f"{pid} ({amt}): {'ready' if not notes else '; '.join(notes)}")

if __name__ == "__main__":
    main()

Run with python3 lab_treasury.py. Verified output:

signer list includes departed: former-cfo
P-31 (800): active approvals 1/2
P-32 (4200): active approvals 2/3
P-33 (950): destination not on allow-list; active approvals 1/2

11.2 Interpreting the output

The script first warns that the signer list still includes a departed former-cfo, which must be fixed before relying on any approvals. P-31 for 800 units has one active approval of two needed. P-32 for 4,200 units has two of three needed because it is large. P-33 for 950 units goes to a destination not on the allow-list, and one of its two approvals came from the departed signer, so only one counts. No proposal is ready. Marcus notes that P-33 needs particular attention because both its destination and its approvals fail policy.

11.3 Deciding next steps

Marcus recommends: remove the departed signer immediately through the change process; reject P-33 and ask the preparer to explain the new destination, confirming it by phone before any new proposal; collect the missing approvals for P-31 and P-32 in the normal way. Ms Holm asks why not simply add the new destination to the allow-list. He explains that adding destinations is itself a controlled change that requires independent verification. The supervised lab shows that automated policy checks inform, but people decide and follow the documented process.

Worked example

The script warns of a departed signer and finds P-31 at 1 of 2, P-32 at 2 of 3 and P-33 failing both allow-list and approvals; none is ready.

Synthetic case. The signers and proposals are synthetic.

Errors and limits

Counting approvals from departed signers lets an outdated list override policy.

Exercises

Synthesis

Policy checks reveal unready proposals, and documented processes decide what happens next.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →