# Tell the Payment Story Before Naming the Requirement

**Session:** FACULTY-SESSION-01  
**Duration:** 75 minutes  
**Program:** WACK-FACULTY-0001

## Learning objective

Students can reconstruct normal, failure, retry, refund, support, administrative, and provider-callback behavior from bounded facts.

## Reviewed pre-reading

- WACK-CONTENT-0154
- WACK-CONTENT-0155
- WACK-CONTENT-0140

## Opening provocation

> The form is hosted. What, exactly, did the university stop owning?

## Activity

Teams build a behavior narrative and two-path relationship map: account-data movement and security influence.

## Student artifact

A one-page payment narrative plus an annotated relationship map.

## Misconception to surface

The system that receives the card data is the only system worth drawing.

## Facilitator stop

Stop any team that draws a scope circle before it can narrate the alternate and administrative paths.

## Exit ticket

Name one component that may never receive account data but can still change the security of the payment journey.

## Authority boundary

W/ Faculty is independent practitioner education and a public pilot. It is not PCI SSC guidance or official PCI SSC training. It is not an accredited curriculum, a certification program, an assessor qualification, an eligibility decision, a grading mandate, or a compliance result. It is not a PCI DSS assessment and does not substitute for assessor judgment, organizational policy, or compliance-accepting-entity direction. Use only fictional or explicitly sanitized environments. Never enter account data, credentials, provider secrets, client evidence, restricted architecture, student records, or targets the class is not authorized to test.