All courses / AI Blue / Module 4 / Chapter 17
Learning objectives
After the lesson the participant can:
- Explain where each tier-1 function goes when triage is largely automated and which role carries it
- Compare the pyramid, the diamond and the flat team by strength, weakness and fit
- Draft a role charter with decision rights as verbs with limits, a ceiling and a list of what the role may not do
- Trace recent incidents through a role map to find empty and double cells at the seams
Key concepts
- Diamond
- A team shape with few tier 1 posts, a wide middle of analysts, investigation leads and detection engineers, and a narrow top. Its weak point is the bottom: a narrow entry rung that needs an apprenticeship by design.
- Role charter
- A role written as a versioned artefact, identified as ROLE-*, beside the code. Decision rights are verbs with limits, ceilings are stated per role, and what the role may not do is part of the charter.
- Agent operator
- The person who watches Mode 5 agents and may revoke their credentials, pause an agent or freeze its write policy. The operator cannot raise an agent's level or widen its mandate.
- Class owner
- A senior analyst who owns the closure of one alert class at Level 3: reads the sampling, tunes the definition with the detection engineer and pauses the class when an escape appears, but cannot raise its level alone.
- Seam
- A place where the blue team's roles meet another team's roles: the security architect, platform engineering, IT operations and the business. Incidents go wrong where a handover assumes the other side holds a right it does not.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Sort
Pyramid, diamond or flat?
Sort each statement under the team shape it describes in the chapter's comparison of the three shapes.
Interactive exercise 2 · Match
What crosses each seam
Match each neighbouring team with what crosses the seam between it and the blue team, as the chapter's table lists it.
Teaching plan
| 15 min | Teacher presents the pyramid under strain and the table of where each tier-1 function goes. |
| 15 min | Groups build a card set of the growing and new roles and assign each to one of the five functions and to a real or fictional person. |
| 15 min | Comparison of the charters ROLE-HM-SOC-LEAD and ROLE-NR-SEC-DET: what each may decide, up to which level, and what each may not do. |
| 35 min | Exercise: participants draw a role map and test it against three recent incidents or near misses. |
| 10 min | Plenary on rotas and the night, using the defaults table, and on why employee representatives are party to the rota and not only to the tools. |
Discussion
- The chapter says the count of posts is the wrong starting point, because the functions that remain differ in kind from the ones that went. What would be the right starting point for a staffing conversation?
- Hansa Mutual's plan commits that no post closes until its holder has been offered a place in the new roles. What makes such a commitment credible to a works council?
- Conway's law suggests the team's structure shapes the detections, playbooks and mandates it builds. Where can you see your own organisation chart in your security tooling?
Written exercise
Exercise · 35 minutes
Drawing the role map and testing it on incidents
Follow the five steps of the practical guide in compressed form. List the people in your team and the roles each plays in the five functions, including part-time roles such as class owner, intelligence analyst, purple team coordinator and evaluation engineer. Write one line per role: what it decides, within what time and up to which level. Mark the seams to the architect, the platform team, IT operations and the business and name the counterpart. Then take three recent incidents or near misses, at least one in which an agent or a provider's AI took part, list the decisions made and find the role that held each right. Mark empty cells, double cells and decisions taken without a charter.
Deliverable: A role map by function with ceilings, named seam counterparts, three traced incidents and a list of charter changes with a review date within 90 days.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
According to the chapter's table, where does the tier-1 function 'learning what normal looks like' go when triage is automated?
Show the answer
D. It must be designed in, as an apprenticeship route
The queue used to teach analysts what normal looks like. Once repetitive classes are closed by class, that learning has to be designed, which Chapter 23 takes up.What may the agent operator do under the default role ceilings?
Show the answer
B. Revoke credentials, pause an agent and freeze its write policy
The operator holds the right to stop: revoking credentials, pausing and freezing write policy. The operator cannot raise an agent's level or widen its mandate.What was Nordvik Region's first move in redesigning its team, recorded in AIDR-0719?
Show the answer
A. It converted one analyst post into detection engineering and shared an agent operator role with the platform team
Nordvik cannot afford a diamond; it converts one post, held by Karin Lund as ROLE-NR-SEC-DET, and shares an operator role. The four-post shift over two years is Hansa Mutual's plan in AIDR-0775.