Respond: Playbooks, Bounded Containment and the Stop Path

All courses / AI Blue / Module 2 / Chapter 10

Learning objectives

After the lesson the participant can:

Classify response actions by reversibility and set the ceiling with the five questions of the practical guide
Describe what a playbook manifest contains and why a policy decision point outside the model must enforce it
Design and drill a stop path that does not run inside the system it stops
Distinguish stopping from reversing and explain the role of the containment ledger in the recovery handover

Key concepts

Playbook manifest: The codified, pre-approved response, identified as PBK-*. It names the trigger, the corroboration required, the action and its class, the limits, the approver, the rollback and the stop path. Everything not listed is denied.
Independent corroboration: At least two sources that do not share a data path must agree before a Level 3 action. Two detections that read the same identity log are one source seen twice.
Stop path: The means by which a person halts a system's further actions. It must not run inside the system it stops: for a SOC agent it revokes the agent's identity at the identity provider and freezes its write policy at the endpoint-detection console.
Stopping versus reversing: A stop halts further actions and does not undo those already taken. Reversal is a separate step carried out by a person, and restart is a deliberate decision by the owner.
Containment ledger: The handover to recovery, generated from the case record: every action taken, by whom or which system, at which level, under which playbook, with its rollback state, the evidence preserved and the credentials rotated.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Which action class?

Sort each response action into the action class the chapter's table gives it, by how far its effect reaches and how fully it can be undone.

Interactive exercise 2 · Scenario

The isolation that interrupted a rollout

Apply the chapter's distinction between stopping, reversing and restarting.

Teaching plan

15 min	Teacher presents response as a decision that trades one harm against another, and the five action classes with examples and default ceilings.
20 min	Ceiling workshop: each group applies the five questions to one response action their team performs often and records the lowest ceiling.
20 min	Guided reading of PBK-HM-ISOLATE-01 version 1.2.0 and of the incident on 2027-04-12, finding the weakness in the corroboration block.
40 min	Exercise: tabletop drill of the stop path following the six steps of the practical guide, with roles for agent operator, duty analyst and SOC lead.
15 min	Input on break-glass, the incident commander, reporting clocks as constraints on the case record and the containment ledger.
10 min	Comparison of where control sits: Nordvik Region through the contract and the console it owns, Hansa Mutual through the platform and the manifest.

Discussion

A model that scores a host at 0.97 has not changed what isolating a production database would cost if the score were wrong. How does this change the way your team talks about confidence?
A commander who approves every Level 3 action has turned the playbook back into Level 2. What should the incident commander spend attention on instead?
Nordvik Region's stop path for its provider's AI is a contractual instruction with a 15-minute target. What must be true for such an instruction to count as a stop path?

Written exercise

Exercise · 40 minutes

Drilling the stop path on the table

Run the stop-path drill of the practical guide as a tabletop for your own agent or for Hansa Mutual's investigation agent HM-SEC-001. Assign the agent operator, the holder who invokes the stop and the SOC lead as observer. Describe the harmless scenario in the pre-production mirror in which the agent proposes a permitted action every thirty seconds. Write down where the independent mechanism sits and confirm it is not in the SOAR layer. Define the two times to be recorded, the attempt of a second action after the stop, and the restart test with a non-owner. Set the target time, and record any failure as a finding with an owner and a re-test date.

Deliverable: A stop-path drill record with roles, mechanism, target time, the two measured times, denial and restart checks, and findings with owners.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

What does the default ceiling of a response action class follow, according to the chapter?
Show the answer
B. The effect of a wrong action
The first observation on the action-class table is that the ceiling follows the effect of a wrong action, not the confidence of the model.
In the incident INC-HM-2027-0455, what weakness of playbook version 1.2.0 allowed a legitimate rollout step to be contained?
Show the answer
D. The two corroborating sources were allowed to share a data path
Version 1.2.0 required two sources but let them share a data path; the endpoint behaviour and identity logs were not independent, and the activity was a step of the scheduler migration CHG-PL-2291.
What is the default ceiling for AC-4 actions such as wiping a host or notifying a regulator?
Show the answer
A. Level 1 Assisted: the system drafts and a named person acts
AC-4 actions are irreversible or external and cannot be recalled, so the AI drafts and a named person acts. Level 4 is never used for an irreversible B4 Respond action.