AI Blue

According to the chapter, what did the three night scenes at Nordvik Region and Hansa Mutual have in common?

1. In each scene an agent took an irreversible action at Level 4 Autonomous without any playbook
2. In none of them did anyone choose a degree of delegation; it came from defaults
3. In each scene the managed provider had breached framework agreement NR-2025-044
4. In all of them a works council had refused consent to the tool

What defines Level 3 Bounded in the chapter's table of degrees of delegation?

1. A person approves each proposed action before it runs, and the model only drafts it
2. The model's confidence score exceeds a threshold that the supplier has set
3. The AI selects and executes actions without a playbook bound or a prior human decision
4. A codified playbook enforced by a policy decision point outside the model

Which evidence would refute the thesis claim 'autonomy matched to reversibility'?

1. Evidence that irreversible containment at Level 4 Autonomous causes less harm than at Level 3 Bounded or below
2. Evidence that queue-centred teams match loop-centred teams on coverage, time to contain and strain on staff
3. Evidence that agents reading attacker-writable input need no more containment than other automation
4. Evidence that analysts' wellbeing is unaffected by working at machine speed and on call

To which function does the chapter assign triage, and why?

1. B2 Detect, because the alert is the product of a detection and its owner must also say what it means
2. B4 Respond, because triage ends in a containment decision
3. B3 Investigate, because B2 answers for whether the alert should exist and B3 for what it means
4. B1 Anticipate, because triage relies on threat intelligence and exposure data

What does Nordvik Region's function map show before any transformation begins?

1. An automation that closes alerts and that nobody accepted for the Region, and three unowned functions
2. A full pyramid of tiers with a named owner for every one of the five functions
3. A detection-engineering team of four that manages detections as code
4. A group red team of five that runs quarterly purple exercises with the detection engineers

What does the chapter say about the measures a SOC traditionally reports, such as mean time to detect, mean time to respond and closure rate?

1. They are obsolete and should be removed from every management report
2. They are required by NIS 2 and therefore cannot be changed
3. They measure individual analysts fairly as long as the figures are reported by name
4. They count speed, volume or coverage, and none counts the quality of a judgement

In the chapter's assumed illustration for a team shaped like Nordvik Region's, what is the relation between demand and capacity in the staffed hours?

1. 600 alerts against a capacity of 300, so half of them go unread
2. 300 alerts against a capacity of 225, so demand is 1.3 times capacity
3. 225 alerts against a capacity of 300, so the team has spare capacity for hunting
4. 300 alerts against a capacity of 600, so the provider is not needed

Which label does the chapter give to fully autonomous campaigns at scale against European targets?

1. Observable, because developers have reported such campaigns
2. Expected, because ENISA judges them highly likely
3. A design assumption that needs no evidence
4. Speculation, because no source documents it

Which of these is one of the chapter's four reasons why pressure does not justify autonomy on grounds of speed alone?

1. Speed that is wrong is faster to cause harm, such as a containment that wrongly isolates a production system
2. AI systems are too slow to match adversaries whose tooling works in bursts of seconds
3. European law prohibits any automated containment action in a SOC
4. Adversaries have not yet been observed using AI anywhere along the attack chain

What is the default ceiling for an AC-3 action, such as disabling the account of a named user?

1. Level 3 Bounded, inside a playbook enforced by a policy decision point
2. Level 4 Autonomous, provided the agent has an identity of its own
3. Level 2 Supervised, with a named human approver
4. Level 0 Advisory, with no drafting by the system

According to the profile rules, what happens to a Level 3 entry that does not name the playbook or closure policy that bounds it and its enforcement by a policy decision point outside the model?

1. It remains Level 3 until the next calendar review of the profile
2. It counts as Level 2, because Level 3 must name its enforcement
3. It is promoted to Level 4 by the grant authority
4. It is removed from the delegation register

What does the review default prescribe when a delegation fails its reversibility test?

1. The test is repeated at the next quarterly drill before anything changes
2. The agent's model is replaced and the level is kept
3. The management body accepts the residual risk in its minutes
4. The entry drops one level at once and further delegation in its function is frozen

Why does the extraction system in the chapter's pipeline hold no tools that act, such as updating a block list?

1. Because adversaries write some of what it reads, so a hostile document must end as no more than a bad proposal
2. Because the AI Act classifies intelligence extraction as a high-risk AI system that may not act
3. Because STIX 2.1 objects cannot be written to a block list automatically
4. Because the exposure feeds are refreshed too rarely for automated use

What does the EPSS feed provide, according to the chapter?

1. A list of vulnerabilities for which exploitation in the wild has already been observed
2. A European database launched by ENISA under the NIS 2 Directive
3. A probability that a published CVE will be exploited in the wild in the next 30 days
4. A ranking of the organisation's assets by internet exposure

In the routine's defaults, what does the seeded-error catch rate control?

1. Whether the extraction system may be promoted to Level 3 Bounded
2. Which analyst receives the reviewer role in the following quarter
3. Whether indicators in the block list are allowed to expire
4. Whether the team may move from full review to sampled review

What is the chapter's central discipline for accepting a detection?

1. It is accepted when the supplier certifies its coverage of the ATT&CK matrix
2. It is accepted when a test shows that it fires and a measure shows what it costs in false positives
3. It is accepted when the drafting assistant reports high confidence in the logic
4. It is accepted when two analysts agree that the rule looks reasonable

Which kind of detection debt describes a detection whose data source is silent or lacks a required field?

1. Stale
2. Orphaned
3. Noisy
4. Blind

What status do supplier-held detections have until the contract grants provenance, logic access, tuning rights and test rights?

1. They are treated as Mode 0 Ambient AI and stay declared rather than verified
2. They are counted as verified in the coverage map, because the supplier updates them continuously
3. They are delegated at Level 3 Bounded under the supplier's playbook
4. They are removed from the coverage map and disabled in the console

Of the five triage tasks in which AI takes part, which one takes the decision away from a person?

1. Enrichment
2. Summarisation
3. Closure
4. Correlation

In the practical guide, what happens to a class after one confirmed escape of high severity or one missed seeded incident?

1. The sampling rate is doubled for the following month
2. It returns to Level 1 Assisted at once, so nothing is closed unread
3. The class owner is replaced by the SOC lead
4. It continues at Level 3 Bounded until the class owner's next review date

Which of these may never be closed by an AI system under the two exclusions that belong in every closure policy?

1. An alert about a tier-0 asset, an executive account or a named person's access to work
2. An alert raised by traffic from a registered internal vulnerability scanner
3. A duplicate of an alert that is already held in an open case
4. An alert that arrives out of hours while the provider is monitoring

Which layer of evidence is the only one the AI writes to?

1. Originals, after they have been hashed at acquisition
2. The evidence manifest, to record its own tool calls
3. Working copies and parsed artefacts, which named tools derive from the originals
4. Analysis products: queries, results, timeline entries and narrative

What is the only evidence action that the chapter delegates at Level 3 Bounded?

1. Acquiring a disk or memory image of a production host with a deterministic tool
2. Collecting defined artefacts from named sources under a codified playbook
3. Releasing evidence to a regulator or a CSIRT
4. Correcting the hashes in the manifest after re-acquisition

What does the chapter require before the activity of a named person is investigated?

1. A named human authorisation from outside the SOC line that states the purpose and the time window
2. A decision by the investigation agent that the evidence meets the stated threshold
3. Continuing observation of the person's behaviour for a fixed period beforehand
4. A characterisation of the person's motive, drafted by the AI for the HR lead

According to the chapter, where does the hunter's judgement sit once AI proposes hypotheses cheaply?

1. In typing queries faster than an assistant can draft them
2. In approving every anomaly cluster that the SIEM or EDR product ranks highest
3. In ranking hypotheses by threat, exposure and existing coverage
4. In disabling suspicious accounts as soon as they are found

What does a hunt that finds nothing establish?

1. That the behaviour is absent from the estate
2. That the detection covering the technique can be retired
3. That the hypothesis came from an unreliable source
4. That nothing was found by these queries, in this data, over this period

What is the fixed end of a hunt finding that reveals a gap in detection?

1. A detection with a passing test, or a dated repeat of the hunt with a reason
2. An immediate containment action taken by the hunting agent
3. A ranking of the analysts who missed the behaviour
4. A request to the grant authority to raise the hunting agent to Level 3 Bounded

What does the default ceiling of a response action class follow, according to the chapter?

1. The confidence score the model assigns to the alert
2. The effect of a wrong action
3. The seniority of the analyst on shift
4. The number of detections that fired in the last hour

In the incident INC-HM-2027-0455, what weakness of playbook version 1.2.0 allowed a legitimate rollout step to be contained?

1. The playbook allowed the agent to wipe the workstation
2. The stop control ran inside the SOAR layer and failed when the shift lead used it
3. The agent held break-glass access to production hosts
4. The two corroborating sources were allowed to share a data path

What is the default ceiling for AC-4 actions such as wiping a host or notifying a regulator?

1. Level 1 Assisted: the system drafts and a named person acts
2. Level 2 Supervised, with each action approved by the duty analyst on shift
3. Level 3 Bounded inside a playbook with a rate limit
4. Level 0 Advisory, with no drafting permitted

When is a finding closed, according to the rule the chapter takes over from AI Red Team, Chapter 26?

1. When the pull request with the change has been merged by the artefact owner
2. When the SOC lead has signed the review record
3. When the re-test that re-runs the original scenario has passed
4. When thirty days have passed without a recurrence

What is the default consequence when a mandate passes its review date?

1. The agent's permissions lapse at the policy decision point
2. The agent continues for 90 days while the review is scheduled
3. The mandate is marked declared in the control catalogue
4. The autonomy ceiling drops one level until the next drill

Which of the chapter's five rules governs what an AI system may read when it drafts a review?

1. It may read any log the analysts can reach, to find missing facts
2. It may read the evidence pack and nothing else; unsupported statements are struck out
3. It may read earlier performance assessments of the analysts who were involved
4. It may read the pack and decide which three changes the team commits to

Why do the safeguards for Modes 1 to 3 rest on the analyst's discipline and the tooling around it?

1. Because these tools are exempt from the organisation's data classification
2. Because the vendors of such tools accept accountability for what the output is used for
3. Because in these modes the AI acts with the analyst's own identity and permissions
4. Because the AI Act forbids logging of conversational assistants

Which of the following goes to no assistant, whatever the route?

1. Credentials and secrets, including those found inside evidence
2. A public threat report that arrived overnight
3. Field names and types from the SIEM schema
4. A published advisory from the national CSIRT, summarised on an enterprise tier

A Mode 3 work tool runs a command that changes an endpoint. How does the chapter classify this?

1. As assistance, provided the analyst reads the tool's output in full afterwards
2. As a Level 0 Advisory action that needs no record
3. As shadow AI that must be reported to the incident process
4. As B4 Respond, which falls under the playbook manifests of Chapter 10

Why does the SOC in the chapter not build a manager agent to oversee the other agents?

1. Because a manager agent would need a larger budget than the mandate manifests allow
2. Because overseeing the last step is not overseeing the chain, and approval is a human act
3. Because the AI Act lists manager agents among prohibited practices
4. Because the hunting agent already assigns work to the other agents

What is the first step of introducing a SOC agent in the practical guide?

1. Level 2 Supervised for one quarter, with a person approving each proposed action
2. Level 3 Bounded for a single closure class with a review at 90 days
3. Shadow mode at Level 0 Advisory for four weeks, with no effect on the queue
4. Level 1 Assisted for eight weeks with the agent's output in the case

Where does the mechanism for stopping the whole agent team sit?

1. At the identity provider and the SOAR connector, outside the agent platform
2. Inside the agent platform, as an instruction in each agent's prompt
3. In the triage agent, which pauses the other agents on request
4. In the model provider's console, where the supplier's on-call engineer withdraws the model

What is the cheapest correction for anchoring, the strongest effect of automation bias, according to the chapter?

1. Asking the agent to state its confidence as a number before the analyst reviews it
2. Replacing the reviewer after every missed seed
3. Doubling the number of reviewers on each shift
4. Changing the order of work: the analyst forms a provisional view before opening the AI's conclusion

Why does the critique agent run on a different model family from the agent it critiques?

1. Because agents on one model family may share blind spots and fail together
2. Because a second model family is cheaper to run at night
3. Because the works agreement requires two suppliers for every tool
4. Because the critique agent needs write access to the case that the first model lacks

In Hansa Mutual's oversight report for the third quarter of 2027, how does a reader learn that the caught-seed rate of 0.86 is fragile?

1. The report omits the number of seeds injected
2. The report notes beside the figure that two more misses would breach it
3. The report ranks the analysts who missed the four seeds
4. The report shows that the rejection rate fell to zero while volume tripled

Into which trust class does the chapter place a web log or a command line recorded by the organisation's own systems?

1. T0 Own, because the organisation's systems produced the record
2. T3 Published, because adversaries may seed the content
3. T1 Telemetry, because the record contains attacker-chosen fields
4. T2 Submitted, because a person wrote the text without technical integrity

Which consequence of a manipulated agent do the controls outside the model not bound, leaving it to the review of Chapter 14?

1. Disclosure, which is held by deny-by-default egress from the agent's runtime
2. Misdirection, the steering of what the analyst believes
3. Action, which is held by the policy decision point
4. Suppression, which is caught by sampling

What status does a control on the SOC's AI have if it has not been tested, under the standard the chapter takes from AI Threat, Chapter 30?

1. Failed, until a supplier certifies it
2. Verified, if the design was reviewed by the security architect
3. Exempt, if the capability runs at Level 1 Assisted
4. Declared, and not verified

Which of these does the chapter say must stay with the organisation whichever operating model it chooses?

1. Round-the-clock monitoring and first triage of every alert, including at night
2. The provider's closure rules and the models behind them
3. Detection content, with its logic in a repository the organisation owns
4. The night shift at a second site in another time zone

What does the sixth term of annex MS-2 require?

1. 20 working days' notice before a model, rule or threshold affecting closure changes
2. A fixed price per closed alert for the duration of the agreement
3. That the provider's AI runs at Level 4 Autonomous out of hours
4. That all telemetry and closure evidence is deleted after each quarterly sample is returned

Why does the evidence to close for bulk mail in annex MS-2 include the gateway click log?

1. Because annex MS-1 already required the provider to return it with every closure
2. Because the closure of CASE-NR-0231 rested on a sender-reputation score although a recipient had clicked
3. Because click logs contain no personal data and are cheap to store
4. Because the email gateway vendor refuses to disclose reputation scores

According to the chapter's table, where does the tier-1 function 'learning what normal looks like' go when triage is automated?

1. To the triage agent, which records it in its mandate
2. To the managed provider, under the framework agreement
3. To the incident commander, during major incidents
4. It must be designed in, as an apprenticeship route

What may the agent operator do under the default role ceilings?

1. Raise an agent's level when the queue is long
2. Revoke credentials, pause an agent and freeze its write policy
3. Approve the disabling of a named person's account inside a playbook
4. Widen an agent's mandate during an incident

What was Nordvik Region's first move in redesigning its team, recorded in AIDR-0719?

1. It converted one analyst post into detection engineering and shared an agent operator role with the platform team
2. It moved four tier 1 posts into detection engineering and investigation lead roles over two years
3. It replaced its six analysts with a fully managed service
4. It built a diamond with a second site for the night shift

Who is the default holder of decision D5, disabling a staff account, and within what time?

1. The triage agent, within seconds, inside a playbook
2. The duty analyst, within 5 minutes, at Level 2
3. The incident commander, within 10 minutes
4. The executive board, within 240 minutes

What did Hansa Mutual's tabletop on decision D7 measure against its targets?

1. Acknowledgement after 5 minutes and a decision after 20 minutes, both inside target
2. A stop of the agent team in 57 seconds against a target of 120 seconds
3. No acknowledgement at all, because the holder was not on the rota
4. Acknowledgement after 18 minutes against a target of 10, and a decision after 51 minutes against 30

Under the chapter's rules, what moves an unanswered page to the deputy?

1. An automatic timer when the response time passes without acknowledgement
2. A phone call from the duty analyst, made when the holder is known to be unreachable
3. A decision by the management body at its next meeting
4. A proposal from the investigation agent to change the holder

At which moment do the clocks open in the chapter's design?

1. When the management body is informed at its next meeting
2. At the earlier of the first flag and the human confirmation, by a rule of the case system
3. When the investigation agent classifies the incident as major
4. When legal counsel has decided what awareness means for the regime concerned

How does the book read the AI Act's Annex III in relation to AI used for security operations?

1. Every triage and investigation agent is a prohibited practice
2. All security AI is high-risk, because it is a safety component of critical infrastructure
3. Security AI is outside the Act's definition of an AI system
4. No listed use describes security operations, though the SOC's AI is an AI system under the Act

What is the AI ceiling for sending a notification to an authority, in the chapter's table across the degrees of delegation?

1. Not delegated: a named person sends it, because the duty cannot be held by a system
2. Level 3 Bounded, inside a playbook with a rate limit
3. Level 2 Supervised, with approval by the duty analyst
4. Level 1 Assisted, with the AI sending the notice once a named person has read the draft

What happens to mean time to respond and closure rate on the day an AI system starts closing defined classes of alert?

1. They become impossible to compute from the case record
2. They worsen until the analysts have learned the new tool
3. They improve, whether or not the system closes correctly
4. They stay the same, because closures by AI are not counted

What is the gaming check for the coverage family?

1. The number of rules deployed in the SIEM
2. The date of the last passing test, carried in every cell of the map
3. The share of alerts closed within the shift
4. The supplier's statement of ATT&CK coverage for its default detections

Which rule does the chapter set for measures about people?

1. Individual figures are shared only with the analyst's line manager
2. The existence of seeding is kept secret from analysts so that nobody can prepare
3. A ticket field collected for another purpose may be reused for appraisal once it is available
4. No measure is computed per named analyst, and agreement with representatives precedes collection

What does the chapter say about evidence on the effect of AI on SOC analysts' fatigue?

1. A large survey from 2025 shows that AI halves analyst burnout
2. Two controlled studies show that AI review increases fatigue
3. The works councils have published measurements of fatigue from Hansa Mutual's group SOC
4. No study the book relies on measures whether reviewing AI conclusions raises or lowers fatigue

Why can Nordvik Region not apply the group size of five to subteams when reporting figures?

1. Because its union has refused all measurement of the team
2. Because with six analysts any subteam would be small enough to identify a person
3. Because the provider owns all the data about the analysts
4. Because national law forbids aggregate reporting about staff in public authorities

Which label does the verdict give to the claim that AI will end alert fatigue?

1. Speculation, like the opposite claim that it makes the work unbearable
2. Observable, on the evidence of the qualitative studies of alarm validation
3. Expected, on the trend of closure by class
4. A design assumption that the team tests by drill

In the competence record CMP-NR-04, why does INV-02 stand at Foundation?

1. Because the analyst held no certificate in evidence handling
2. Because the two assessors disagreed by a level and recorded the average of their grades
3. Because the lower of the two passes counts, and evidence handling slipped without the assistant
4. Because Nordvik Region's framework has no level above Foundation

What does a certificate support in the chapter's framework?

1. Foundation only; everything above rests on an exercise or on tested work
2. Practitioner, if the certificate is less than two years old
3. Advanced, when it is combined with an attestation from the person's line manager
4. Any level, provided the provider of the course is accredited

What happens under Hansa Mutual's competence conditions when fewer than two evidenced holders of the required competence exist at a site?

1. The agent is retired and its manifest is closed
2. The management body is asked to accept the residual risk in its minutes
3. The remaining holder is given a higher level to compensate
4. The Level 3 Bounded ceiling falls back to Level 2 Supervised

How does the chapter read the finding that Hansa Mutual's measured unassisted share was 0.10 where its policy sets 0.20?

1. As proof that the policy share was set too high and should be halved
2. As a finding: a share set in policy and not measured erodes first
3. As a rounding effect of the small number of cases in the quarter
4. As a breach by individual analysts to be raised in appraisal

Which statement does the chapter label speculation?

1. That people working beside reliable automation check less
2. That unexercised skills decay in settings other than the SOC
3. That the entry rung disappears altogether, so that organisations hire no juniors
4. That closure by class and summarising by default are decided trends in the two organisations

Who is the mentor of Nordvik Region's trainee analyst, and why?

1. The second senior analyst, because Karin Lund's time budget contains no mentoring
2. Karin Lund, because she owns the detections the trainee will learn from, starting with DET-NR-0001
3. The provider's service manager, under annex MS-1
4. The CISO, because the unit has no senior analysts

Which posture does the horizon register prescribe for a trend labelled speculation?

1. Commitment: the team builds for it today
2. Preparation: the team builds the option and the skills
3. Deferral: the team ignores the trend until the next yearly review of the register
4. Reversibility: the team avoids decisions that are expensive to undo

How does the chapter label a SOC with no human accountable for containment?

1. Observable, because managed services already work this way
2. Speculation, and the series' rule on irreversible actions argues against it
3. Expected, on the trend of AI adoption that respondents to the ISC2 survey of 2025 report
4. Required by law for essential entities from 2027

Which of these is one of the five thresholds that would change the author's projection?

1. A vendor announcing a model with higher benchmark scores
2. A fall in the number of alerts raised per day in the reader's own SOC for two quarters
3. At least two organisations showing analysts reaching investigation-lead competence without a tier 1 post
4. A rise in the number of certificates held by the team

Why is the Arup deepfake fraud useful to a blue team, according to the chapter?

1. Because it shows how an endpoint detection caught the fraud before any payment was made
2. Because it shows that deepfake video calls are detected reliably by the email gateway
3. Because nothing happened that a blue team's telemetry could see: no internal system was compromised
4. Because it was stopped by an agent acting at Level 3 Bounded

In the rubber-stamp case from INC-HM-2027-0455, why was the second isolation approved in 38 seconds?

1. Because the approval screen did not show the asset tags
2. Because the incident commander was asleep and a deputy acted
3. Because the playbook allowed shared assets at Level 3 Bounded
4. Because the critique agent had already approved the proposal

At which usage mode does the anti-pattern 'the provider's black box' concentrate?

1. Mode 3 Agentic work tools, because the analyst's identity is borrowed
2. Mode 5 Autonomous production agents, because the stop path sits inside the agent
3. Mode 1 Conversational assistants, because prompts are not logged
4. Mode 0 Ambient AI, because the level is undeclared until the contract says

What did Nordvik Region's first out-of-hours stop drill on 2027-05-13 find?

1. That the provider failed to page within the five minutes annex MS-1 requires
2. That no manager on the rota held the console role needed for the stop
3. That the isolation playbook had isolated a citizen-facing service
4. That the stop took 57 seconds against a target of 120 seconds

How was the escaped phishing closure CASE-NR-0231 found?

1. By the Region's weekly sample of the provider's closed alerts
2. By the provider's own quarterly escape report
3. By a seeded incident injected under annex MS-2
4. By the Region's triage assistant NR-SEC-001, which reopened the alert

Which of these is one of the three conclusions the book draws from the year's records?

1. The failures were found by luck, which shows the limits of the design
2. Aggregate-only reporting cost the SOC most of its useful measures
3. Agents removed the load from the night shift entirely
4. The records that mattered most were written before they were needed

What is Nordvik Region's conclusion for its regional director, recorded in AIDR-0713?

1. That the unit should become a 24/7 SOC with its own agent team
2. That a large in-house SOC can let agents act at night if every stop is drilled and review is measured
3. That a small hybrid team transforms by owning the few things that decide its quality and making the rest visible by contract
4. That the provider's AI should be granted Level 4 Autonomous for low-severity alerts out of hours

What must a closure class's own record show before Hansa Mutual extends Level 3 Bounded to it under measure H1?

1. A closure rate above the group average for one month
2. No escape in its own sample and a seeded catch of at least 0.85 for two quarters
3. A recommendation from the supplier of the triage agent's model
4. A median time to close below 30 seconds with a reopen rate of zero for a full quarter

According to the comparison table, what is the source of leverage for each organisation?

1. Nordvik Region: the contract and the rules it owns; Hansa Mutual: the platform and the agent team
2. Nordvik Region: a large pyramid of analysts; Hansa Mutual: a single managed provider's AI
3. Nordvik Region: its group AI governance board; Hansa Mutual: public procurement law
4. Nordvik Region: seven legal regimes; Hansa Mutual: one jurisdiction and public law

Which part of the thesis does the chapter judge the weakest, argued but not proved?

1. That the blue team is transformed, not abolished
2. That autonomy is matched to reversibility, with a stop path outside the system it stops
3. That the defenders' AI is part of the estate that is defended
4. That the route by which analysts are made and their wellbeing are design questions

Which of the twelve questions does the chapter leave open?

1. Who may isolate, disable or disclose, and how fast
2. Whether AI reduces or intensifies fatigue
3. Which functions may be delegated, to what degree, and who decides
4. Who is accountable for a missed intrusion that AI closed

In the author's projection for 2036, what is a person alone expected to do in B4 Respond?

1. Contain anything wide, irreversible or person-related, disclose and command
2. Execute reversible containment inside a playbook that a policy decision point enforces
3. Assemble evidence packs and run re-tests
4. Read, extract and correlate intelligence reports