Design Authority, Decision Forums and Gates Instead of Meetings

All courses / The Transformed Security Architect / Module 4 / Chapter 17

Learning objectives

After the lesson the participant can:

• Explain the three ways forums fail and the three things a gate does that a meeting does badly.
• Classify decision classes into the four tiers, with a decider, evidence, a time limit and a maximum autonomy level for an AI proposer.
• Write an exception as an expiring record with a tested compensating control and renewal requirements.
• Apply the delegation test and shadow running to redesign a review board as a design authority with gates.

Key concepts

Tier policy as data

A list of decision classes in version control, each with a tier, a decider, required evidence, a time limit and an owner, read by gates and forums. A class qualifies for tier 1 only if a machine can check its evidence.

Direction decides the ceiling

A class that loosens a boundary is never delegated as far as one that tightens it. For AI proposers, tightening or restoring changes may reach Level 3 Bounded behind an external gate; loosening changes stay at Level 2 Supervised or below.

Working gate

A gate whose rule is versioned and tested, whose rule is not owned by the author of the change it gates, whose bypass is possible, visible and reviewed, and which is itself reviewed for staleness. The override rate measures its health.

Design authority

The tier 2 forum for exceptions, deviations, precedent and contested items. It works asynchronously first on pull requests, has a written mandate and a quorum by role, and an objection from the security architect escalates to the next tier and is not outvoted.

Expiring exception

A record of a decision to live with a control gap for a stated time, with an owner, a tested compensating control and an expiry enforced by a gate. Renewal is a new decision that requires new evidence, not an extension.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The chapter says a design authority that approves every pull request in seconds is a gate with a delay. How would you tell the difference in your own forum?
2. Gates that cannot be bypassed will be bypassed unseen. What would a break-glass path need to record in your pipeline for you to trust it?
3. Hansa measures and delegates; Nordvik designs a route and writes down who answers at the end of it. What does a tier policy offer an organisation with no standing board?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Before a class of decisions is delegated from the board to a gate, what does the chapter's practical guide require of shadow running?

   1. Two weeks in which the gate records no failures or overrides of any kind
   2. One full quarter in which the board approves every item of the class unchanged and no exception is open against it
   3. Gate and board agree on at least 95 per cent of at least 20 decisions, every disagreement explained
   4. A sample of five per cent of the gate's decisions re-derived by internal audit
   Show the answer

   C. Gate and board agree on at least 95 per cent of at least 20 decisions, every disagreement explained
   The class runs in shadow for four weeks and is delegated only when gate and board agree on at least 95 per cent of at least 20 decisions and every disagreement is explained.

2. In Hansa's tier policy, at what maximum level may an AI propose a change to the tier policy itself or to a stop path?

   1. Level 0 Advisory: an agent must never change the rule that governs it or the path that stops it
   2. Level 1 Assisted, with the draft labelled as AI-generated
   3. Level 2 Supervised, with each change approved by the head of security architecture and recorded at tier 3
   4. Level 3 Bounded, where the change tightens the policy
   Show the answer

   A. Level 0 Advisory: an agent must never change the rule that governs it or the path that stops it
   Classes C7 and C8 are at Level 0 Advisory for any AI proposer, because an agent must never change the rule that governs it or the path that stops it. Both are tier 3 decisions.

3. What does the chapter say about renewing an exception?

   1. It is extended automatically for the same period while the compensating control keeps passing its test
   2. It may be extended once by the control owner without a new decision
   3. It is granted by the gate when the expiry date is reached
   4. It is a new decision that requires new evidence; a renewal attaching nothing new is declined
   Show the answer

   D. It is a new decision that requires new evidence; a renewal attaching nothing new is declined
   Renewal is a new decision, not an extension, and requires new evidence such as a supplier's committed date or a fresh test result. A renewal attaching nothing new is declined.