The Purple Loop Defined: Five Stages, Evidence and the Independence Principle

All courses / AI Purple / Module 1 / Chapter 4

Learning objectives

After the lesson the participant can:

• Explain each of the five stages by the question it answers and the record it produces.
• Classify findings into the five states of the closure rule and say which may be reported as closed.
• Draft a delegation profile with a ceiling, a decider and a stop holder for each action class.
• Review a loop's independence declaration against the five kinds of separation, the incentive rule and the three proofs.

Key concepts

Stage records

Each stage is defined by its record: a scenario record (SCN) at P1, an emulation plan and run log (EMU) bounded by rules of engagement (RoE) at P2, a finding (FND) and purple session record (PRP) at P3, a change at P4, and a regression case (REG) with an evidence manifest (EVD) at P5.

Closure rule

A finding is closed only when the re-test and its variant pass, the evidence manifest is signed and attached, and a named person signs the closure with its date. The five states are open; implemented, unverified; re-test failed; closed and verified; risk accepted.

Delegation ceiling

The highest autonomy level, from Level 0 Advisory to Level 4 Autonomous, allowed for an action class at a stage. The lowest ceiling governs, and Level 4 is never used for an emulation action that is irreversible, leaves the signed scope, touches personal data beyond authorisation or targets a named person.

Independence principle

A check counts only where the side that tests and the side that is tested can fail in different ways. It is declared as five kinds of separation (model, data, authorship, vendor, time), one incentive rule between roles and three proofs: held-out scenarios, seeded gaps and reproduction.

Purple-team coordinator

The role that runs the loop: it schedules, makes sure findings reach their owners in a usable form and tracks the age of open findings. It is accountable for the flow and legibility of the register and is never a third team.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A white-team sample at Hansa Mutual found 6 of 20 closed findings had been closed when the change merged. Why is that state so easily reported as closed, and who has an interest in the difference?
2. Nordvik Region signs only P2, P3 and P5 with its counterparties and keeps P1 and P4 internal. What does that choice say about which decisions can be bought and which cannot?
3. The book says a kind of separation that is not shown is treated as shared. Which of the five kinds would your organisation find hardest to show, and what would compensate for it?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. A change has been merged for a finding but the re-test has not yet run. How is the finding reported under the closure rule?

   1. As closed, because the change was reviewed and merged by its owner.
   2. As risk accepted, because no evidence exists either way.
   3. As re-test failed, because the absence of a pass counts as a failure.
   4. As open, in the state implemented, unverified.
   Show the answer

   D. As open, in the state implemented, unverified.
   The state implemented, unverified means a change is merged or deployed and the finding is still reported as open. Only closed and verified, with a passed re-test and variant, signed evidence and a dated signature, counts as closed.

2. What is the recommended ceiling for declaring a finding closed and verified at P5 Verify?

   1. Level 3 Bounded, enforced by the regression case outside the runner.
   2. No delegation: the runner proposes and a named closure owner signs.
   3. Level 2 Supervised, with the purple-team coordinator sampling results.
   4. Level 4 Autonomous, provided the scenario is benign and reversible.
   Show the answer

   B. No delegation: the runner proposes and a named closure owner signs.
   Running and recording a codified re-test may reach Level 3 Bounded, but declaring closure is never delegated. The table states: person; no delegation. The runner proposes and the closure owner signs.

3. Which set names the three proofs of the independence declaration?

   1. A signed manifest, a stop path and a white-team approval.
   2. Model, data and vendor separation between the two sides.
   3. Held-out scenarios, seeded gaps and seeded errors, and reproduction.
   4. A re-test, a variant and a dated signature on the closure.
   Show the answer

   C. Held-out scenarios, seeded gaps and seeded errors, and reproduction.
   The three proofs are held-out scenarios the detection builders did not see, seeded gaps and seeded errors that show the check can fail, and reproduction. Model, data and vendor are three of the five kinds of separation, not proofs.