Tools · Module 1 · The Toolbox

Introduction: A Toolbox for the Series

The lesson sets the boundary of the reference. Participants classify tools into the four kinds, separate tools from laws and from the series' concepts, read the inventory figures for what they claim, and practise reading an entry row by row. A worked search for the post-incident review shows the ten-minute test that the book sets for itself, and the two fictional organisations are introduced as two scales of tool use.

Lesson 1 of 25Chapter 160 minutes

Read the chapterThe whitepaperThe slides

All courses / Tools / Module 1 / Chapter 1

Learning objectives

After the lesson the participant can:

Key concepts

Artefact
A template, manifest, record, register, checklist, policy or schema that a book defines: a document with a structure, usually YAML or Markdown, kept in version control and read by people and often by software. Artefacts are the largest group in the inventory.
Own tool
Software or a script that a book or its repository provides, such as the Maturity Radar of Architecture as Code. The 227 publishing scripts of the ten repositories are inventoried and listed in Appendix A but not treated in the chapters.
Third-party tool
Software, a platform, a library, a service or an open standard that a book names as something practitioners use, such as Terraform, Open Policy Agent or Sigma. It is described only from its own documentation and only as far as the series' claims go.
Method
A named, repeatable procedure with steps, an input and an output, such as burn-rate alerting, a game day or a pre-mortem. It differs from a general idea in that someone could follow it on Monday.
The rows of an entry
Kind, Origin, Purpose, Use when, Inputs, Outputs, Identifier family and Full template, in a fixed order. A row is omitted when the originating book does not say, and two to six sentences of prose follow the table.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Which kind of tool is it?

Sort each tool into the kind that Chapter 1 gives it. The examples are the chapter's own.

Interactive exercise 2 · Match

What each row of an entry tells you

Match each row of an entry in Parts II to VII with what it tells the reader, as Table 1.3 sets out.

Teaching plan

10 minThe teacher opens with the problem the book solves: a practitioner had to know which of ten volumes to open. Present the four kinds with the chapter's examples and the things that are not tools.
10 minWalk through Tables 1.1 and 1.2 of the inventory and the three rules of compilation. Participants say what the count per volume does and does not show.
10 minRead the rows of an entry together and replay the worked example: the search for the prefix PIR, the choice between the review of AI Blue and that of AI Operations.
20 minExercise: participants run the ten-minute test on their own next piece of work and record the path they took.
10 minDebrief in plenary: which searches succeeded, which tools sat in an unexpected chapter, and how Nordvik Region and Hansa Mutual would differ in the choice.

Discussion

  1. Why does the book refuse to treat the AI Act, the GDPR, DORA and NIS 2 as tools, and what would a reader lose if it did?
  2. The count of entries per volume says how many tools a volume defines or names, not how useful it is. What other readings of Table 1.2 should a teacher warn against?
  3. An entry may relate to two chapters and be treated in one. How should a team that builds its own catalogue handle the same problem?

Written exercise

Exercise · 20 minutes

The ten-minute test on your next piece of work

Name one piece of work you must do in the next month, for example a post-incident review, a supplier renewal or the approval of an agent. Using Appendix A or the Tool Finder at tools.geon.se, search by name or identifier prefix for the tools the series offers for it. For three tools, write down the kind, the originating book and chapter, the purpose in one sentence and the inputs you would need. Where two artefacts share a prefix, as the two post-incident reviews do, state which one fits your case and why. Time yourself and note where the search stalled.

Deliverable: A one-page search log: the task, three tools with kind, origin, purpose and inputs, the choice made between any artefacts that share a prefix, and the minutes used.

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

  1. According to the chapter, what distinguishes a method from a general idea?

    Show the answer

    B. It has steps, an input and an output, so someone could follow it on Monday
    The chapter defines a method as a named, repeatable procedure with steps, an input and an output that the reader applies. Identifier prefixes belong to artefacts, and laws are not tools at all.

  2. Of the 240 own tools in the inventory, how many are publishing scripts that are listed in Appendix A but not treated in the chapters?

    Show the answer

    D. 227
    227 of the 240 own tools are the publishing scripts of the ten repositories. The remaining 13 own tools and the other 1,402 entries are treated in the chapters; 114 is the number of third-party entries mentioned only in passing.

  3. In the worked example, why does the reader preparing a review of a service outage choose the post-incident review of AI Operations over that of AI Blue?

    Show the answer

    A. The two share the prefix PIR, but the review of AI Operations serves a service incident and that of AI Blue a security incident
    The two artefacts share a prefix and serve two kinds of incident. The reader's first decision is which one fits, and for a service outage it is the review of AI Operations, whose Inputs row leads to the incident record.