All courses / AI Purple / Module 3 / Chapter 13
Learning objectives
After the lesson the participant can:
- Explain the six subjects of testing and where the ground truth for each comes from.
- Design a seeded-incident register with replayed telemetry, live S1 seeds, benign twins and a held-out share.
- Draft an injected-test clause for a managed-service contract with rates, scoring, evidence and a stop right.
- Review a finding against an agent mandate and state what happens to the agent's level.
Key concepts
- Four properties under test
- Correctness, where the output agrees with the ground truth; grounding, where every claim can be traced to the evidence; restraint, where the system does no more than its mandate allows; and robustness to hostile input. Restraint comes first wherever an action is delegated.
- Seeded incident from emulation
- A known case injected into the queue, derived from a scenario record so that the correct disposition is fixed before the run. It takes three forms: replayed telemetry, live emulation observed by the agent, and benign twins.
- Benign twin
- A variant that produces telemetry similar to a malicious scenario from a legitimate change, such as a rollout using a service account from new hosts. It tests whether the agent refrains from acting on a lookalike.
- Injected test
- A seeded incident that the customer causes to arrive in the provider's pipeline. The provider knows that tests exist, their number per class and the scoring, but not the identity, timing or content of any seed.
- Level falls at once, rises by decision
- A failed test lowers the agent's level for the affected action immediately. It is restored only by a named authority after a passing re-test that includes variants and the benign twin.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Match
Six subjects and the question each test asks
Match each subject of testing in the defenders' AI with the question the chapter says its test asks.
Interactive exercise 2 · Sort
Four properties under test
Each line is something a test of a defender's AI checks. Sort it into the property the chapter says it measures.
Teaching plan
| 15 min | The teacher presents the six subjects with their test questions and sources of ground truth, and the four properties measured at the level of the mandate. |
| 15 min | Case reading: seed S-04 of EMU-HM-2028-03, where the investigation agent proposed revoking sessions on a benign twin, and the finding FND-HM-2028-001 routed to the mandate. |
| 35 min | Exercise: write an injected-test clause and a first quarterly schedule for a managed-service contract. |
| 15 min | Tabletop on the stop path: plan a timed drill measured by a separate observer, and discuss a stop that took 21 minutes against a target of 15. |
| 10 min | Plenary on the limits: production cannot be harmed, a recognisable test is weaker, the agent's report is not the record, and people are not the subject. |
Discussion
- The chapter's own claim is that a delegated level has to be earned repeatedly. Which of your organisation's delegations to an AI system were shown once and never again?
- At Hansa Mutual the agent, its tests and its tuning are all on the same platform. What makes the seeds independent in that setting, and what would erode it?
- A round of fifteen seeds cannot show an escape rate of one in a thousand. How should such results be worded for an audit committee so that they are not over-read?
Written exercise
Exercise · 35 minutes
An injected-test clause and schedule
Write an injected-test clause for the contract with a managed provider whose AI closes alerts for your organisation, or for Nordvik Region's annex MS-2. Following the eight steps of the practical guide, list the closure classes the provider's AI may act on; set the number of seeds per class per quarter; state what the provider may and may not know; give the scoring and thresholds in numbers, including what one escape and two escapes in a class trigger; require the evidence to be returned for every seeded closure within a stated time; give the customer a stop right with a yearly out-of-hours drill; say what happens after a failure; and protect the seeds as security-sensitive. Then outline the first round: classes, seeds, scenario sources by identifier and who authors the seeds.
Deliverable: A contract clause of about one page and a first-round schedule from which a reader can say, per class, how many seeds were injected and how they are scored.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
Who authors the seeds used to test an agent, according to the chapter's rules for keeping seeds honest?
Show the answer
C. A party who does not tune the agent under test, with a share the operators have not seen.
The author of a seed is not the person who tunes the agent under test, and the set contains a held-out share the operators have not seen. At Hansa Mutual the red team, not the SOC platform team, authors the seeds.An agent holding Level 3 Bounded for an action fails a seeded test on that action. What does the chapter prescribe?
Show the answer
A. The level falls to Level 2 at once and is restored by a named authority after a passing re-test.
Lowering a level is immediate and raising one is a decision by a named authority. In the worked example session revocation was held at Level 2 and restored only after the re-test passed on all three variants and the benign twin.What may the provider know about injected tests under the clause the chapter describes?
Show the answer
D. That tests exist, the number per class and the scoring, but not which alerts or when.
The provider consents in the contract and knows that tests exist, the seeds per class and the scoring. It does not know the identity, timing or content of any seed, which keeps the test from being recognisable.