Investigate: Hypotheses, Timelines and Evidence with AI

All courses / AI Blue / Module 2 / Chapter 8

Learning objectives

After the lesson the participant can:

Apply the checks on AI-written queries and AI-assembled timelines that keep an investigation honest
Explain the three evidence layers and which actions on evidence an AI system may take at which level
Review an AI-assisted case with the five checks before closure
Describe the five rules that apply when the activity under investigation is a person's

Key concepts

Three evidence layers: Originals are acquired once, hashed and stored write-once. Working copies and parsed artefacts are derived by named tools. Analysis products are queries, results, timeline entries and narrative, and are the only layer the AI writes to.
Check outside the model: A deterministic script, not the model, opens each event cited in a timeline entry and confirms that timestamp, host, account and action match the record. An entry without a reference is labelled as inference.
Empty result as a claim: A query that returns nothing is evidence of absence only if the query could have found something. The case records the queries that returned nothing and the sources that were not available.
Reproducibility: An investigation is reproducible when a second analyst, given the case record and access to the evidence, can repeat the work without the AI and reach the same conclusions or explain the difference.
Three layers of a narrative: Every narrative separates what is established, with an evidence reference; what is assessed, with the analyst's confidence and reasoning; and what is unknown, with what would resolve it.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Put in order

The investigation loop

Put the six steps of the investigation loop in the order of the chapter's table.

Interactive exercise 2 · Scenario

Reassurance found in the evidence

Apply the chapter's controls for hostile content in evidence.

Teaching plan

15 min	Teacher introduces the mailbox forwarding case at Hansa Mutual's Dutch subsidiary and walks the loop table: investigator, AI contribution and verification per step.
15 min	Query-reading drill: participants read three AI-drafted queries described in prose and find the unintended filter, the wrong time zone and the join that drops events.
15 min	Short input on forensics, the action-class table for evidence and the five architectural controls for hostile content in evidence.
40 min	Exercise: pairs act as reviewer of CASE-HM-1207 and run the five checks before closure on the record as given.
20 min	Discussion of investigating people: authorisation from outside the SOC line, metadata before content, events not intent, and why an investigation is not a watching brief.

Discussion

Verification cannot mean reading everything the AI read. Which of the chapter's checks would you insist on for a conclusion about scope, and which could be sampled?
The chapter says content aimed at an AI reader is itself a finding. How should a team record and use such a finding without overreading it?
At Nordvik Region a second reviewer is scarce, so a case below high severity may be closed provisionally and reproduced within five working days. What does that compromise protect and what does it risk?

Written exercise

Exercise · 40 minutes

Five checks on an AI-assisted case

Take the role of the market reviewer for CASE-HM-1207, the external forwarding rule in a claims correspondence mailbox, or use a closed case of your own with personal data removed. Starting from the evidence manifest and the timeline, not the narrative, run the five checks of the practical guide: grounding and alternatives; independent reproduction of every query behind a conclusion on scope, impact or containment; hostile content and permissions; custody; and scope and proportionality. For each check write what you examined, the result and any correction, such as the UTC stamp that the AI read as local time. State whether the case may be closed and in whose name.

Deliverable: A review record with the five checks, their results, corrections made, the three narrative layers and a closure recommendation.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Which layer of evidence is the only one the AI writes to?
Show the answer
D. Analysis products: queries, results, timeline entries and narrative
The AI reads working copies and parsed artefacts and writes only analysis products. It never alters an original or a manifest; write-once storage and the absence of write permission enforce this.
What is the only evidence action that the chapter delegates at Level 3 Bounded?
Show the answer
B. Collecting defined artefacts from named sources under a codified playbook
Collection from defined sources runs at Level 3 Bounded under a playbook enforced by a policy decision point. Imaging a production host is Level 2 Supervised, and release or alteration is not delegated at all.
What does the chapter require before the activity of a named person is investigated?
Show the answer
A. A named human authorisation from outside the SOC line that states the purpose and the time window
The first rule is a named authorisation from outside the SOC line, from the HR lead and the privacy officer or as national procedure and the works agreement provide. The AI describes events, never intent.