Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path

All courses / AI Purple / Module 2 / Chapter 6

Learning objectives

After the lesson the participant can:

• Explain why the rules of engagement, the mandate manifest and the decision record are kept apart and which ceiling governs.
• Classify scenarios into safety classes S1 to S4 and state the environment and level each allows.
• Draft a rules-of-engagement manifest whose every sentence a policy decision point can evaluate.
• Design a stop path with machine-detectable abort conditions, named holders and a drill.

Key concepts

Rules-of-engagement manifest

A signed, versioned file (RoE) that says what may be done to which systems, when, with whose consent and under what stop conditions. It belongs to the exercise or programme and is enforced by a policy decision point outside the agent.

Scope as code

Scope in a form read at every action: default deny, exclusions checked before inclusions, the manifest outside the agent's reach, and refusal tested by three dry runs against an out-of-scope target, after the window and with a stop flag set.

Safety classes S1 to S4

S1 is benign, reversible and tagged; S2 is reversible with bounded side effects; S3 needs realistic state or may disturb service and never runs in production; S4 has impact or irreversible effect, or involves staff or third parties.

Stop path

The mechanism, held by named people outside the emulating system, that denies further actions at the policy point, revokes the system's credentials and egress, and invokes the clean-up. It needs no approval to use and is drilled.

White team

The control group that governs the exercise: it owns the manifest and its versions, holds or delegates the stop path, runs deconfliction and keeps the record. It lies outside both the red team and the SOC so that it can stop either.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The chapter says a control that has never refused anything has not been shown to work. Which controls around your own testing have never been seen to refuse?
2. Nordvik Region's risk is a manifest signed once and treated as a formality; Hansa Mutual's is a pipeline running inside rules nobody has re-read. Which is closer to your organisation, and what keeps the rules alive?
3. A managed provider is on the blue side of an exercise and also holds a stop path. How should the two roles be reconciled in a contract?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. A manifest allows Level 3 Bounded for class S1 scenarios, but the agent's mandate allows only Level 2 Supervised. At which level does the agent run?

   1. Level 3 Bounded, because the manifest belongs to the exercise.
   2. Level 2 Supervised, because the lowest ceiling governs.
   3. Level 4 Autonomous, once the white team has signed both documents.
   4. Level 1 Assisted, because any conflict falls back to the minimum.
   Show the answer

   B. Level 2 Supervised, because the lowest ceiling governs.
   The chapter keeps the rules of engagement and the mandate manifest apart and states that the lowest ceiling governs. With a mandate at Level 2 Supervised, the agent runs at Level 2 whatever the manifest would allow.

2. What does the stop path do, in order, when a halt is called?

   1. It asks the emulating system to finish its current step and report.
   2. It notifies the red-team lead, who decides whether the run continues.
   3. It pauses the schedule, opens a ticket for the red-team lead and waits for the system owner to approve the halt.
   4. It denies further actions, revokes credentials and egress, and invokes the clean-up.
   Show the answer

   D. It denies further actions, revokes credentials and egress, and invokes the clean-up.
   The stop path sets the stop flag at the policy point, revokes the emulating system's credentials and egress and triggers the deterministic clean-up. The emulating system takes no part in any of the three, and stopping needs no approval.

3. Which safety class does the chapter assign to a scenario that involves staff, such as a social-engineering test?

   1. S4, with AI limited to Level 0 Advisory and named people acting.
   2. S1, provided every action is tagged and reversible.
   3. S2, with white-team approval for each run in production.
   4. S3, run on a range or mirror at Level 3 Bounded.
   Show the answer

   A. S4, with AI limited to Level 0 Advisory and named people acting.
   Exercises that involve people are class S4. For S4 the ceiling is Level 0 Advisory: AI may plan only, and a named operator acts with per-step white-team approval, under the agreements with employee representatives.