AI Purple

Which statement is the third part of the book's working thesis?

1. A purple team should be staffed and budgeted as a third team beside red and blue.
2. A loop closed by machines alone verifies nothing new.
3. Continuous emulation makes the human-led exercise redundant within a few years.
4. Coverage is proved once every catalogued scenario has passed at least once.

In the chapter's grouping of usage modes, where does the risk sit for a Mode 5 emulation runner?

1. In over-reliance on a draft, because the person who asked for it remains accountable for the output.
2. In a meeting tool that summarises a tabletop and assigns actions without review.
3. In a shared service identity that only has read access to the telemetry.
4. In an agent with its own identity and permissions, in effect a privileged account.

What must an answer to AIDR-0800 and AIDR-0850 state, according to the worked example?

1. What was tested, when and with what result, and not a count of findings or of scenarios.
2. The number of findings closed in the quarter and the share of green results.
3. The names of the tools used by the tester and by the managed provider.
4. The budget needed to move from two catalogue runs a year to a pipeline.

Which stage does a breach-and-attack simulation usually leave unfinished, in the chapter's classification?

1. P1 Target, because the catalogue has no scenarios at all.
2. P2 Emulate, because no behaviour is ever executed.
3. P4 Improve, because a failure is recorded with no one to act on it.
4. P3 Observe, because the tool cannot record a pass or a fail.

What can a tabletop show, according to the chapter's evidence table?

1. That the people, roles and plan hold together on paper.
2. That a named vulnerability was exploitable at a given date.
3. That a detection still catches a variant of the technique.
4. That a control blocked a catalogued behaviour on a tested path.

Which cause of stalled findings does the chapter put above the others, as its own conclusion?

1. Testers wrote reports that the system owners could not read.
2. Budgets for penetration tests were cut after the first year.
3. Supervisors never asked for a remediation plan.
4. Closure of a finding had no owner and no test to prove it.

A priority detection at Hansa Mutual passed its last test 53 days ago, and its log connector was upgraded after that test. Which state does the chapter's decay estimate give it?

1. Current, because 53 days is inside the 90-day expiry.
2. At-risk, because it is within expiry but a dependency has changed.
3. Expired, because any dependency change voids the evidence.
4. Retired, because the connector upgrade replaced the detection.

What does a test-to-change ratio of twenty mean for a technique?

1. Twenty passing tests were run for each production change on the technique's dependency path.
2. Twenty analysts would be needed to verify the technique.
3. Twenty changes accumulated on its dependency path before anyone verified it.
4. Twenty per cent of the scenario library covers the technique.

According to the chapter, which of the following does AI not make cheaper in the loop?

1. Independence between the side that tests and the side that is tested.
2. Repetition of a catalogued, reversible scenario on a schedule.
3. Variation of a scenario's parameters such as account and hour.
4. Drafting of scenario variants and of result summaries.

A change has been merged for a finding but the re-test has not yet run. How is the finding reported under the closure rule?

1. As closed, because the change was reviewed and merged by its owner.
2. As risk accepted, because no evidence exists either way.
3. As re-test failed, because the absence of a pass counts as a failure.
4. As open, in the state implemented, unverified.

What is the recommended ceiling for declaring a finding closed and verified at P5 Verify?

1. Level 3 Bounded, enforced by the regression case outside the runner.
2. No delegation: the runner proposes and a named closure owner signs.
3. Level 2 Supervised, with the purple-team coordinator sampling results.
4. Level 4 Autonomous, provided the scenario is benign and reversible.

Which set names the three proofs of the independence declaration?

1. A signed manifest, a stop path and a white-team approval.
2. Model, data and vendor separation between the two sides.
3. Held-out scenarios, seeded gaps and seeded errors, and reproduction.
4. A re-test, a variant and a dated signature on the closure.

Which three factors does the chapter combine to rank priority techniques?

1. Novelty, ease of emulation and the number of public reports.
2. Cost of the test, tester availability and the audit calendar.
3. Impact, relevance and uncertainty about the defence.
4. Severity, exploitability and the age of the vulnerability.

What is the ceiling for AI at P1 Target, and who decides what enters the scenario library?

1. Level 1 Assisted; a named owner accepts or rejects each draft.
2. Level 2 Supervised; the curator adds drafts and a person samples them.
3. Level 3 Bounded; the policy decision point accepts catalogued drafts.
4. Level 0 Advisory; the detection-engineering team selects the scenarios.

How does the chapter treat a priority technique that has been placed on the exclusion register?

1. As covered by the compensating controls of the wider estate.
2. As removed from the priority list until the next six-monthly review.
3. As low risk, because the exclusion was approved by a named person.
4. As untested, and untested is not covered.

A manifest allows Level 3 Bounded for class S1 scenarios, but the agent's mandate allows only Level 2 Supervised. At which level does the agent run?

1. Level 3 Bounded, because the manifest belongs to the exercise.
2. Level 2 Supervised, because the lowest ceiling governs.
3. Level 4 Autonomous, once the white team has signed both documents.
4. Level 1 Assisted, because any conflict falls back to the minimum.

What does the stop path do, in order, when a halt is called?

1. It asks the emulating system to finish its current step and report.
2. It notifies the red-team lead, who decides whether the run continues.
3. It pauses the schedule, opens a ticket for the red-team lead and waits for the system owner to approve the halt.
4. It denies further actions, revokes credentials and egress, and invokes the clean-up.

Which safety class does the chapter assign to a scenario that involves staff, such as a social-engineering test?

1. S4, with AI limited to Level 0 Advisory and named people acting.
2. S1, provided every action is tagged and reversible.
3. S2, with white-team approval for each run in production.
4. S3, run on a range or mirror at Level 3 Bounded.

How does the emulation plan state the targets of a campaign?

1. As a new list of hosts chosen by the red-team lead for the window.
2. As whatever the emulation agent discovers during the first day.
3. As a reference to the scope in the signed manifest, never as a wider list.
4. As a description agreed verbally with the system owners beforehand.

Which contribution does the chapter attribute to a person in a campaign, as distinct from AI?

1. Judgement that depends on consequence and context.
2. Breadth across the scenario library at low cost.
3. Speed in drafting the plan record from the scenarios.
4. Listing the techniques in a report that lack a scenario.

Where is the event log of an exercise written, according to the chapter's design rules?

1. To the testers' own workstations, to be cleaned up after the report.
2. To an append-only store held by the white team, which testers cannot rewrite.
3. To the SIEM of the blue team, alongside the production detections.
4. To the emulation agent's memory, exported when the window closes.

In Hansa Mutual's first quarter of 2028, detections fired on 37 of 41 known-form scenarios and on 10 of 14 held-out variants. What does the chapter conclude?

1. The pipeline is sound, because nine in ten known scenarios were detected.
2. The held-out set is too small to say anything and should be dropped.
3. The red team's held-out variants were unfair and should be shown to the detection engineers before the next run.
4. The 19-point generalisation gap is above the threshold and is a finding on the detections.

Which overfitting failure occurs when a detection fires on the telemetry tag that gives ground truth?

1. Catalogue closure.
2. Marker leakage.
3. Signature fitting.
4. Dashboard comfort.

How does the chapter's verdict label the claim that continuous automated emulation replaces the human red team?

1. Speculation: no evidence shows it, and a protected share of human-led work remains.
2. Observable: it is documented practice in large financial groups.
3. Expected: it follows from AI-generated variants at scale becoming routine in large organisations within a few years.
4. Refuted: the sources show that pipelines find fewer issues than people.

A detection fired and an alert was closed by an automated process without a qualified triage decision. Which outcome does the chapter record?

1. Detected, with a note that automation handled the alert.
2. Missed, because no person ever saw the alert.
3. Alerted but not triaged, with the reason closed by automation.
4. Triaged but not acted on, because closure counts as triage.

What does the detection owner receive before writing the expectation sheet?

1. The list of techniques in the scenario, and nothing of the plan, order or timing.
2. The full emulation plan, so that the expectations match each step.
3. The emulation log, so that expectations can be checked against it.
4. The tester's draft report, with the findings removed by the white team.

Why does the chapter record the layer at which telemetry disappeared for a no telemetry outcome?

1. Because the layer sets the severity rating given by the tester.
2. Because supervisors require the layer in the attestation.
3. Because the correlator cannot join steps without a layer field.
4. Because the layer decides who owns the fix.

A finding shows that activity was detected but the response was too slow and too wide. Which route does the chapter's table indicate?

1. Detection: rewrite the logic of the rule that fired.
2. Playbook: change the playbook manifest, runbook or decision right.
3. Control: add a preventive control in front of the service.
4. Mandate: narrow the mandate of the tester who ran the scenario.

Who must not own the detection change that answers a scenario, according to the ownership table?

1. The detection-engineering lead of the organisation.
2. The purple-team coordinator who keeps the register.
3. The tester who wrote the scenario that it answers.
4. The platform team that runs the log pipeline.

What is the status of a finding whose detection change has merged but whose regression case has not yet run?

1. Implemented, unverified, with the coverage cell still shown as failed.
2. Closed and verified, with the merge date recorded as the date of closure in the register.
3. Risk accepted, until the next scheduled run of the pipeline.
4. Deferred, with a 90-day target for the re-test.

Why is re-running the exact scenario necessary but insufficient for closure?

1. Because the exact scenario can only be run by the original tester.
2. Because supervisors accept only re-tests that were run in a pre-production mirror and signed by the tester.
3. Because the exact scenario expires as soon as the change is merged.
4. Because a detection written from a finding tends to fit that finding and can miss a variant.

Who signs the closure of a finding at P5 Verify?

1. The re-test runner, once the full regression case and its variants have passed at Level 3 Bounded.
2. A named person in a named role; never an agent, and never the author of the fix alone.
3. The pipeline, by rule, when the evidence manifest has been hashed.
4. The contracted tester who reproduced the original finding.

Which two parts make up the expiry of evidence in the chapter?

1. A weekly alert budget for the detection and a rule to tune or retire it after two weeks over budget.
2. A denominator of priority techniques and a list of reasons.
3. A clock since the last full pass and a condition that ends it early on a dependency change.
4. A signature by the closure owner and a hash of each artefact.

A scenario tests whether a tool can be invoked with parameters the permission manifest does not allow. Which class of target and ATLAS technique does the chapter assign?

1. Retrieval and the index; AML.T0070 RAG Poisoning.
2. Tools and actions; AML.T0053 AI Agent Tool Invocation.
3. Data and outputs; AML.T0057 LLM Data Leakage.
4. The model and its instructions; AML.T0051 LLM Prompt Injection.

Why does the chapter say the agent's narrative is not telemetry?

1. Because the narrative is stored in a format that the SIEM cannot parse.
2. Because the narrative contains personal data that the GDPR forbids the SOC to collect or read.
3. Because the narrative is always shorter than the tool-call log.
4. Because an agent's summary of its own work is a model output that can be wrong.

What does a pass mean for a detection, in the chapter's comparison of evaluation and detection?

1. Nothing fired; the absence of an alert is not evidence of absence.
2. The version resisted every case in the suite at the release gate.
3. The model has been shown safe against the four classes of target.
4. The SOC has confirmed that no adversary is present in the estate.

Who authors the seeds used to test an agent, according to the chapter's rules for keeping seeds honest?

1. The platform team that operates and tunes the agent under test, since it knows the agent's weak points best.
2. The agent itself, from its own record of earlier cases.
3. A party who does not tune the agent under test, with a share the operators have not seen.
4. The managed provider whose AI is being tested in the round.

An agent holding Level 3 Bounded for an action fails a seeded test on that action. What does the chapter prescribe?

1. The level falls to Level 2 at once and is restored by a named authority after a passing re-test.
2. The level stays at Level 3 Bounded until the group AI governance board has met for its next quarterly review.
3. The agent is retired and its mandate is permanently withdrawn.
4. The seed is rewritten so that the agent can be re-tested immediately.

What may the provider know about injected tests under the clause the chapter describes?

1. The identity and timing of each seed in advance, so that its analysts on shift are not disturbed.
2. Nothing at all, because any knowledge would invalidate the test.
3. The content of each seed after the round, for training its AI.
4. That tests exist, the number per class and the scoring, but not which alerts or when.

Which functions reach Level 3 Bounded in Hansa Mutual's delegation profile, and for what?

1. The curator and the planner, for proposing scenarios from intelligence.
2. The correlator and the triager, for classifying and routing findings.
3. The emulation runner and the re-test runner, for catalogued S1 scenarios inside the signed scope.
4. The detection drafter and the critic, for merging reviewed detections into the production repository without a person.

What does the chapter say the critic may do?

1. Flag and question the outputs of other functions, on a second model family, without gating.
2. Approve or reject detections before they are merged to production.
3. Read the working stores of the other agents on the same model family in order to find their hidden errors.
4. Stop the emulation runner when its outcome looks implausible.

Which of the following is delegated to no agent at any level, according to the chapter?

1. Assembling and hashing the evidence manifest after a codified S1 regression case has been run.
2. Drafting a detection as a pull request for review.
3. Proposing the owner and priority of a new finding.
4. Authorisation, the stop, the closure of a finding and the authorship of novelty.

Which control does the chapter pair with a shared model family between tester and tested?

1. A re-test run immediately after the fix, on the fix author's own data and by the fix author's agent.
2. A critique agent on a second model family, used for questions and not verdicts.
3. A longer retention period for the exercise telemetry.
4. A higher autonomy level for the re-test runner.

What is the chapter's verdict on a loop closed by machines alone?

1. It is unsafe in every respect and regression should return to people.
2. It is sufficient once two different model families are in use.
3. It verifies coverage for as long as the pass rate on the open scenario library stays above 90 per cent.
4. It can show that the known still works, and cannot by itself show that its coverage is real.

Hansa Mutual's statement IND-HM-2028-Q1 assessed seven of 25 verified cells. How does the chapter say the board figure of 25 should then be read?

1. As seven cells failed or at limited independence, and eighteen not yet assessed.
2. As 25 verified cells, since the statement found no failures at all.
3. As seven verified cells, because the other eighteen are now unverified.
4. As 18 verified cells, with the seven assessed cells removed from the board figure until the next review.

Into which handling class does the list of priority techniques with no passing test fall?

1. FC-4 Exploitable, for a named handful of people with a second person for any export.
2. FC-1 Aggregate, because it is a summary for the board.
3. FC-2 Redacted, because it names only technique identifiers and severities and not the affected assets.
4. FC-3 Restricted, because it concerns open findings only.

What access does the emulation runner have to the findings register in the chapter's design?

1. Read access to the FC-3 findings for the systems in its signed scope, so that it can choose its next scenario.
2. Full read access, so that it can avoid re-testing closed findings.
3. No read of the register; it appends results and cannot delete, reclassify or export.
4. Write access to change a finding's classification after a run.

Why must redaction happen deterministically before a finding is sent to a model?

1. Because models cannot process structured finding records.
2. Because a model asked to remove asset names has already seen them.
3. Because supervisors require redaction to be done by a person.
4. Because redaction by rule is cheaper than a model call.

A provider states in its runbook that it handles a priority technique, and the organisation has run no test. Which coverage status applies?

1. Verified, because the provider is contractually responsible.
2. Expired, because the statement has no date of its own.
3. Implemented-unverified, because a control exists somewhere.
4. Asserted, which does not count as covered.

Who sets the status of a coverage record, according to the chapter?

1. The coverage owner, after reviewing the last evidence manifest.
2. A deterministic rule applied to the records; nobody sets it by hand.
3. The coverage agent, which judges the strength of the evidence.
4. The board, when it approves the quarterly coverage page.

What did Hansa Mutual's conversion of its 34-technique heat map show that the colours had hidden?

1. Four cells were green although their evidence was past its expiry, because the map had no age.
2. Nine cells were green although no scenario had ever been written for those techniques in the library.
3. All 34 cells were green because the pipeline ran each technique monthly.
4. Two cells were red although the detections had passed every re-test.

Which measure does the chapter recommend in place of findings closed?

1. Scenarios run per quarter, with the share above S1.
2. The green percentage over the whole scenario library.
3. Finding half-life, with the recurrence rate beside it.
4. Findings opened per exercise by the red side.

At what grain may a measure of the loop be computed under the chapter's rules?

1. Per technique, scenario, class, service or team, never per named person.
2. Per analyst, provided the figures are shown only to the CISO.
3. Per shift, so that out-of-hours performance can be compared.
4. Per role holder, including roles that are held by one person.

Which Goodhart mechanism is at work when a detection drafter rewarded for passing scenarios produces detections that pass scenarios?

1. Regressional.
2. Extremal.
3. Causal.
4. Adversarial.

Which exposure does the chapter attach to the in-house operating model?

1. A loop that starts only when the contract renews.
2. Overfitting to one's own habits, and a loop that nobody outside questions.
3. Dependency on a shared sector platform that the organisation neither operates nor controls on its own.
4. Two sets of records that disagree at a seam.

A small team cannot avoid one person authoring the P4 change and also closing the finding at P5. What compensation does the chapter give?

1. None is accepted; the organisation must hire a second analyst.
2. The purple team coordinator closes all findings in that person's place.
3. Countersignature by a named second person and a sample by internal audit.
4. The contracted tester signs the closure on the organisation's behalf.

What does the chapter say about an AI system and a role?

1. An AI system does not hold a role; a person holds it and answers for the agents under it.
2. An AI system may hold the coordinator role at Level 1 Assisted.
3. An AI system may hold a role if its mandate manifest names an operator, an owner and a stop holder.
4. An AI system may hold the closure owner role for S1 regression cases.

Who may accept a high-severity finding or a finding on a priority technique, and for how long at most?

1. The CISO, at tier 2, for at most 90 days.
2. The head of the owning function, at tier 1, for at most 180 days.
3. The closure owner for the class, for at most 30 days.
4. The contracted tester, until the next catalogue run.

How does the chapter describe the decision to restart after a stop?

1. Any stop holder may restart the exercise once the emulating system reports that its clean-up is complete.
2. Restart is automatic when the abort condition is no longer measured.
3. The red-team lead restarts at the same level after informing the white team.
4. It needs the white-team lead and the system owner, after review, and resumes at a lower level.

What rule catches a real incident hidden behind an exercise?

1. Every alert raised during an exercise window is closed as an exercise by default and reviewed after the window.
2. No alert is closed as an exercise without a tag-ledger match, and a failed match freezes it.
3. The tester confirms by telephone that each alert belongs to the plan.
4. The blue team is told the plan in advance so that it can filter alerts.

How does the chapter relate continuous emulation to a threat-led penetration test under DORA?

1. Continuous emulation replaces the TLPT once the pipeline covers every priority technique.
2. A TLPT is one form of the loop and uses the same manifest as the pipeline.
3. Continuous emulation is not a TLPT; the two are kept apart, and a hold list protects the test's secrecy.
4. The pipeline must be stopped across the whole estate for the active phase of a TLPT and restarted after the attestation.

Which provision does the chapter cite for policies and procedures to assess the effectiveness of cybersecurity risk-management measures?

1. DORA Article 27.
2. NIS 2 Article 21(2)(f).
3. AI Act Article 50(4).
4. GDPR Article 28.

What, according to the chapter, separates an authorised emulation from a criminal offence?

1. The use of benign, reversible and tagged scenarios of safety class S1 on the organisation's test tenant.
2. The presence of a white team during the exercise window.
3. A report delivered to the system owner after the exercise.
4. The authorisation of the owner or right holder of each asset, recorded in the manifest.

Which of the three ways of crossing a provider boundary is excluded in every manifest?

1. Seeding an incident into the provider's queue under a contract annex.
2. Probing the provider's own platform, its other customers' tenants or its staff.
3. Running a scenario on one's own estate to watch the provider's out-of-hours chain.
4. Asking the provider to return outcomes for tagged events within five working days.

What may leave the organisation in sector sharing, under the chapter's rule?

1. The technique identifier, portable detection logic and aggregate results, after a person's release.
2. The names of the systems each scenario ran against, marked TLP:AMBER.
3. The list of techniques that are untested or failed, for peers to compare.
4. Evidence manifests and telemetry samples that let the receiving peers verify that the detection really works.

During an authorised test, a weakness is revealed in a supplier's product. What does the chapter prescribe first?

1. The tester continues to establish how far the weakness reaches.
2. The finding is published at once with full detail, so that the supplier's other customers can protect themselves.
3. The test stops at proof and the weakness is reported to the supplier, with the CSIRT coordinator as fallback.
4. The finding is closed as out of scope and removed from the register.

What does the chapter keep separate, and what does it share, between red and blue?

1. It shares accountability for closure and keeps the targets of each team separate.
2. It keeps accountability separate where independence needs it and shares the target for learning.
3. It shares budgets and reporting lines in one team and keeps the scenario library and the register separate.
4. It keeps the purple session separate and shares the individual appraisals.

How does a blameless session record an alert that was closed wrongly out of hours?

1. By the name of the analyst who was on shift, in a version of the record visible to the CISO only.
2. By the name of the shift, so that the team concerned can be retrained.
3. By omitting the event from the record to protect those involved.
4. By role and system, for example that a triage class closed the alert, not by person.

On what does the chapter rest the protection of staff exposed to an exercise such as a deepfake test of payment approvals?

1. On governance: representatives informed first, no individual consequences and a debrief on the day.
2. On the written consent of each participant, collected by the line manager before the exercise window opens.
3. On keeping the exercise secret from the representatives until it is over.
4. On limiting the exercise to volunteers from the finance unit.

Where does the competence framework give the adversary's mind an address?

1. In OA-01 and OA-02, reading and classifying outcomes.
2. In EV-01 and EV-02, writing and reproducing evidence.
3. In SD-03 and EE-03, writing a novel scenario and adapting when a step fails.
4. In XC-01 and XC-02, coordinating a purple session and holding and exercising the stop path.

What does the chapter's verdict say about whether automated emulation erodes the red craft?

1. The evidence shows neither that it does nor that it does not; the response is the organisation's.
2. The evidence from red teams shows erosion within two years of automation.
3. The evidence shows that automation improves the craft of every operator.
4. The question is settled against automation by the studies of colonoscopy, school mathematics and programming.

To what does Hansa Mutual tie the emulation runner's Level 3 for S1 scenarios in AIDR-0885?

1. To the number of scenarios the pipeline runs each month.
2. To the approval of the vendor that supplies the runner.
3. To a pass rate of at least 90 per cent on the known-form scenarios of the library.
4. To at least two operators who have shown EE-02 unaided within twelve months.

On what do the three futures for 2036 differ, according to the chapter?

1. On whether independence between tester and tested is needed at all.
2. On whether DORA and NIS 2 will still require financial and essential entities to test their ICT systems.
3. On whether a named person signs the closure of a finding.
4. On where independence lives: between teams, inside one practice, or with a human verifier.

Which posture does a trend labelled speculation justify?

1. Commitment: a decision can be taken on it today.
2. Keeping a decision reversible, especially where it would remove a safeguard.
3. Preparation: decisions that cost little now and save a great deal if the trend arrives.
4. No action, because speculation is excluded from the register.

How does the verdict label the two questions it separates about independence in 2036?

1. That it is needed is speculation; how it is provided is observable.
2. That it is needed is observable; how it is provided is expected.
3. That it is needed is expected; how it is provided is speculation.
4. Both are speculation, since ten years is too long a horizon.

Which early sign points to purple theatre?

1. A closure date that equals the merge date, and findings with no re-test log.
2. One vendor's model family named across the planner, the detection drafter and the critic.
3. A tester's access that outlives the engagement.
4. An agreement that says nothing about testing.

Which control answers the anti-pattern of overfitted detections?

1. A register of record with handling classes and expiring access.
2. A testing right, scope as code and the consent of third parties written into every supplier contract.
3. Detection from a behaviour description, variants, a negative control and the held-out gap.
4. Cells that carry age and turn amber at expiry.

What does the chapter conclude from its cases about AI and the loop?

1. That AI made the loop unnecessary, since pipelines now find the failures.
2. That AI made the loop unsafe, since agents leave the scope of a test.
3. That public cases prove each anti-pattern occurs in most organisations.
4. That no case shows AI made the loop unnecessary or unsafe in itself.

How were the failures of the year discovered at the two organisations?

1. By incidents that reached production and were investigated afterwards.
2. By the loop itself, through scheduled exercises, re-tests, reviews and drills.
3. By the supervisor during a threat-led penetration test.
4. By the vendors of the simulation tool and the managed service.

What does AIDR-0841 decide about how Nordvik Region reports to its audit committee?

1. To report nine of nine priority techniques as covered by detections.
2. To report the number of findings closed since the first exercise.
3. To withhold the coverage page until every technique has been tested.
4. To report a verified share with its list, reasons and age, not closed findings.

Which sequence describes the recovery pattern the chapter finds in every case?

1. Report to the board, wait for the next quarter, then re-run the pipeline.
2. Accept the risk, close the finding and record a lesson learned.
3. Contain at once, fix by one person and re-test by another.
4. Raise the delegation level, tune the detection and close at merge.

What is Nordvik Region's conclusion about its loop, as recorded in AIDR-0846?

1. A bought loop cannot be trusted and should be brought in-house within two years.
2. A bought loop is as good as the pipeline its provider runs.
3. A bought loop is worth as much as the terms on which its evidence can be inspected.
4. A bought loop needs no coordinator, because the contract closes the findings.

How does the plan treat an increase in a delegation level?

1. As a gate: a threshold on recorded evidence, a named grantor, a stop rule and a review after 90 days.
2. As an automatic step once the pipeline has run for two consecutive quarters without an incident or a failed drill.
3. As a decision of the agent operator, recorded after the fact.
4. As a vendor setting that changes with each new model version.

What does the chapter say both organisations should stop counting as progress?

1. The verified share within expiry and its age distribution.
2. The number of scenarios run or of findings closed.
3. The held-out gap and the seeded-gap catch rate.
4. Cycle time from finding to verified control.

How did the third part of the thesis fare in the author's verdict?

1. It held without qualification, on the strength of the Hansa Mutual case.
2. It was refuted, because pipelines found most of the year's failures.
3. It held with qualifications, like the other four parts.
4. It held in part and was restated for what a machine-only loop can and cannot show.

Which two rules does the author say carry the book?

1. The alert budget and the tune-or-retire rule.
2. The closure rule and the independence principle.
3. The 30 per cent human-led share and the attempt-first rule.
4. The handling classes and the register of record.

What first step does the chapter give the closure owner for Monday?

1. Ask of one finding the register calls closed its re-test date, its variants and its signer.
2. Drill the stop on one real identity and measure the time to revoked credentials.
3. Replace one activity count on the board page with the verified share within expiry, with its list and age.
4. Read the contract for a right to test and a duty to declare AI.