Freeze the baseline
Read the facts without repairing them. Name the current authoritative fact version.
W/ FORMATION BREAK · 45 MINUTES
ONE FACT MOVED.
DID THE FORMATION?
Test whether one changed payment fact causes Scope, Applicability, Implementation and Responsibility, Evidence, and their downstream consumers to move together.
Start the workshopCHANGED FACT→FOUR POSITIONS→TEN CONSUMERS→BOUNDED DISPOSITION
Safety and authority boundary
This fictional practitioner exercise exposes dependencies, contradictions, and unsupported claims. It does not decide PCI DSS scope, requirement applicability, compliance, validation eligibility, provider responsibility, or acceptance. Use fictional or sanitized information only. Working notes remain on the device unless the participant downloads them.
Facilitator clock
Fly four positions
Record one bounded claim and one unresolved question for each position.
Inject the change
Reveal the serverless function, workload identity, and support queue.
Move the consumers
Classify each downstream artifact as move, reopen, or hold with a stated reason.
Reconcile contradictions
Name the first stale relationship, unsupported claim, and ownerless verb.
Bound the disposition
State what is supported, what remains unresolved, who owns the next fact, and what reopens the decision.
Observe the method
Capture the first missed dependency, oral rescue, smallest repair, and retest condition.
DEVICE-LOCAL WORKSHOP · WACK-DIAMOND-LAB-0001
BREAK THE FORMATION.
FIND THE FIRST FRACTURE.
Do not repair the scenario while reading it. Record the first dependency the room misses and the first explanation the facilitator has to supply.
The webhook that moved only one document
- 01Northwind Market uses a hosted checkout supplied by a payment service provider.
- 02A production payment-status webhook is exposed through the entity's cloud edge service.
- 03The application inventory and architecture diagram name the new endpoint.
- 04External vulnerability and ASV scan target records still list the prior public addresses.
- 05The penetration-testing methodology does not describe webhook behavior or its trust boundaries.
- 06The provider responsibility record describes payment processing but does not identify callback delivery or customer receiver operation.
- 07A screenshot from staging is attached to a production control claim.
One bounded claim. One unresolved question. Each.
Scope
Reopen the represented subjects and relationships.Which people, processes, technologies, locations, data flows, connected relationships, security-influencing relationships, and provider services require fresh analysis?
STOP RULE Do not turn an Internet-facing endpoint or provider dependency into an automatic in-scope or out-of-scope conclusion.
Applicability
Reopen predicates that depended on the prior facts.Which obligations, reporting responses, testing questions, or prior N/A conclusions relied on the old endpoint, identity, data path, or operating model?
STOP RULE Do not treat a row in an instrument as the conclusion; preserve the tested fact, authority, response, and reopening trigger.
Implementation and Responsibility
Name the operating verbs and accountable owners.Who configures, deploys, monitors, scans, tests, changes, responds, preserves, and proves the edge, function, identity, queue, provider handoff, and support use?
STOP RULE Do not replace the verb map with 'the provider handles it' or assign the repair to the assessor.
Evidence
Bound what can be supported now.Which objects support the correct subject, population, period, environment, and procedure—and where do staging evidence, stale targets, or absent propositions stop the claim?
STOP RULE Preserve contradictions. Do not let evidence volume repair a stale fact or an undefined population.
03 / CONSUMER FAN-OUT
0/10Move it. Reopen it. Or defend the hold.
System and component inventory
Does it identify the edge, function, workload identity, queue, and relevant environments?
Software and application inventory
Does it identify the receiver code, dependencies, deployment source, and change owner?
Architecture and data-flow narrative
Do the diagram and narrative agree about normal, failure, support, identity, and provider paths?
Public-presence and scan target records
Have the actual terminating hostnames and infrastructure been reconciled to the applicable scan populations?
Penetration-testing methodology
Does the method test the relevant external interface, trust transitions, identity, and application behavior?
Provider assurance and responsibility
Do the exact service, callback behavior, customer configuration, and retained verbs reconcile to current assurance?
Identity and access records
Is the workload identity attributable, bounded, reviewed, monitored, and linked to the correct deployment?
SDLC and change record
Can the released function and configuration be traced from approved change through testing and production?
Evidence contract and claims ledger
Do the evidence subject, environment, population, period, and provenance match the production claim?
Assessment and reporting responses
Which prior assertions must reopen before the assessment can describe the current environment?
Record where the material—not the participant—failed.
Portable workshop kit