Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops

All courses / AI Purple / Module 5 / Chapter 19

Learning objectives

After the lesson the participant can:

Compare the four operating models by who runs each stage, what is bought and what is left exposed.
Draft an operating-model decision per stage with exit criteria stated as numbers.
Draft a role charter with mandate, decision rights, prohibitions and the agents under the role.
Review a small team's role assignments against the forbidden pairs and name the compensation for each unavoidable pair.

Key concepts

Four operating models: In-house, contracted, hybrid and sovereign or sector. An operating model answers per stage who does the work, who is accountable and where the records live, and an organisation usually runs a mixture.
What must stay: Whatever the model, the organisation keeps the coordinator, the closure owner, the white team, the register of record and the right to stop. The model buys capacity and a different view.
Role charter: A versioned ROLE artefact with a holder and deputy, the mandate, accountabilities, decision rights, prohibitions and the agents under the role. An AI system does not hold a role; a person holds it and answers for what agents do under it.
Forbidden pairs: Pairs of roles or acts that the same person must not hold, such as authoring a scenario and the detection it tests, or authoring a change and closing its finding. Where unavoidable, the compensation is countersignature, sampling, a held-out scenario or a contract clause.
Viable minimum loop: A loop in which the five stages exist, each stage has an owner and a deputy, and the forbidden pairs are kept apart by contract, countersignature or sampling. Nordvik Region's uses two own people, two counterparties, two borrowed people and sampling by internal audit.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

Roles of the loop and what each never does

Match each role with what the chapter's role table says its holder never does.

Interactive exercise 2 · Scenario

A tester's terms

Apply the chapter's four terms for every purchase of the loop to a negotiation at Nordvik Region.

Teaching plan

15 min	The teacher presents the four models with Hansa Mutual as in-house and Nordvik Region as contracted, and notes that hybrid and sector are argued from the instruments.
15 min	Participants map who runs each of the five stages in their organisation today, including a provider's AI that acts only in practice.
35 min	Exercise: write an operating-model decision with exit criteria and one role charter for the purple team coordinator or exercise controller.
15 min	Groups test a six-person team against the table of forbidden pairs and assign compensations, using Karin Lund's hats as the case.
10 min	Plenary on procurement: the four terms that should appear in every purchase of the loop and what a supplier's refusal tells the buyer.

Discussion

The coordinator can escalate a stale finding without approval and cannot close one. Why does the charter grant the first right and refuse the second?
Nordvik Region's loop rests on five people, none full time, and two counterparties. Where is its single point of failure, and what would you do about it first?
The chapter says buying the loop is buying a right to learn from a result and not only a service. Which clauses in your current testing contracts secure that right?

Written exercise

Exercise · 35 minutes

Operating-model decision and a role charter

For your own organisation or Nordvik Region, list the five stages and the party that runs each today. Mark what must stay with the organisation. Score your preferred model per stage on whether it can show evidence within expiry, whether its independence can be shown, and whether the organisation could exit. Write the decision as a short record with an owner, a review date within twelve months and exit criteria as numbers, and test the exit on paper: what moves, to whom, in how many working days. Then write a role charter for the purple team coordinator: holder and deputy, mandate, accountabilities, decision rights, what the role may never do, and the agents under it.

Deliverable: A per-stage operating-model decision with numeric exit criteria and a one-page role charter with decision rights and prohibitions.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Which exposure does the chapter attach to the in-house operating model?
Show the answer
B. Overfitting to one's own habits, and a loop that nobody outside questions.
The in-house model gives speed and depth and leaves exposed overfitting to one's own habits and a loop nobody outside questions. The other options are the exposures of the contracted, sovereign or sector, and hybrid models.
A small team cannot avoid one person authoring the P4 change and also closing the finding at P5. What compensation does the chapter give?
Show the answer
C. Countersignature by a named second person and a sample by internal audit.
For the pair authors the change and closes the finding, the table gives countersignature by a named second person and sampling by internal audit. Nordvik Region applies it through the deputy CISO's countersignature.
What does the chapter say about an AI system and a role?
Show the answer
A. An AI system does not hold a role; a person holds it and answers for the agents under it.
Roles are not delegated; tasks are. The charter lists the agents under a role, and the person who holds the role answers for what they do. Even where the re-test runner records a result, the closure owner signs every closure.