All courses / AI Purple / Module 6 / Chapter 23
Learning objectives
After the lesson the participant can:
- Explain why a scoreboard of red wins when blue loses makes honest reading costly, and what the shared target replaces it with.
- Draft a purple session charter with rules on recording, readers, pauses and the use of results.
- Classify the four sources of load on a team and propose a spacing rule for tested activities.
- Review a plan for an exercise that involves staff against the four points of governance.
Key concepts
- Shared target
- Red and blue are measured together by the share of priority techniques verified with evidence of a stated age, the time from finding to verified control and the held-out catch, while accountability for findings, changes and closure stays separate.
- Blameless, not accountless
- A session identifies contributing causes without indicting an individual, records roles and systems and not names, and lets no result enter an appraisal. The class owner, the person who granted a level and the closure owner still answer for design and decisions.
- Withhold the instance, not the class
- The charter and works agreement state that seeded incidents, injected records and tagged scenarios exist and in what classes. Only which case, when and with what content is withheld, and a missed seed counts against the system, not a person.
- Four sources of load
- The exercise window, the stop path that requires a reachable holder, the findings that become work, and the reviewing of machine output. Only the last is new, and tested activities are spaced so that a team is not always being tested.
- Governance for staff exercises
- Representatives are informed first; consent is not the legal basis; no result has individual consequences because the result belongs to the control; and staff are debriefed on the same day with a way to talk.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Put in order
Ground rules of a blameless session, in sequence
Put these steps of the chapter's practical guide for a blameless purple session in the order in which the guide numbers them.
Interactive exercise 2 · Scenario
A request for a name
Apply the chapter's rules for a blameless session to a request made after a purple session at Hansa Mutual.
Teaching plan
| 10 min | The teacher opens with the scoreboard problem and the chapter's note on method: no study in its bibliography measures the wellbeing of red teams or the effect of a purple session. |
| 15 min | Groups read Hansa Mutual's joint scorecard SCR-HM-2028-Q1 and identify the gaming checks and the prohibitions. |
| 30 min | Exercise: write a purple session charter and an exercise-information notice for staff representatives. |
| 10 min | Role play of two minutes each: the facilitator redirects sentences of the form X should have into the form the process allowed. |
| 10 min | Plenary on the purple coordinator as translator, the strains of the role, and how it is measured by the flow and legibility of the register. |
Discussion
- The joint scorecard changes what a good quarter means without changing who closes a finding. Why does the chapter insist on both halves of that sentence?
- Large field studies of phishing simulations found limited value in the training. What does that imply for what an exercise involving staff should be designed to test?
- Nordvik Region's small team is both examiner and examined. Which of the session rules matter most when the same six people will meet again next quarter?
Written exercise
Exercise · 30 minutes
A session charter and a staff notice
Write two short artefacts for your own organisation or for Nordvik Region. First, a purple session charter following the practical guide: purpose, who attends by role, what is recorded and what is not, who may read the record, how long it is kept, that the session opens with what held, that the record names roles and systems and not people, that any participant may pause without giving a reason, and that no result enters an appraisal. Second, an exercise-information notice for a class S4 exercise that involves staff: the kind of exercise, the unit, the window, the working days of notice to the representatives, what staff are told in advance and on the day, and that the result belongs to the control and has no consequence for any person.
Deliverable: A one-page session charter and a one-page staff notice, both dated before the session or window they govern.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
What does the chapter keep separate, and what does it share, between red and blue?
Show the answer
B. It keeps accountability separate where independence needs it and shares the target for learning.
The tester answers for the quality of findings, the engineer for the change and a named person for each closure. The shared target is verified coverage with evidence age, time from finding to verified control and the held-out catch.How does a blameless session record an alert that was closed wrongly out of hours?
Show the answer
D. By role and system, for example that a triage class closed the alert, not by person.
The session record names roles and systems and not people: the triage class closed the alert. Names appear only where a person holds a decision, and the facilitator asks what the system made easy.On what does the chapter rest the protection of staff exposed to an exercise such as a deepfake test of payment approvals?
Show the answer
A. On governance: representatives informed first, no individual consequences and a debrief on the day.
In employment an employee can rarely refuse without consequence, so consent is a weak basis. Protection comes from governance: the representatives see the scenario in advance, the result belongs to the control, and staff are debriefed the same day.