# W/ Faculty Answer and Intervention Boundary

| ID | Instructor may | Instructor may not |
| --- | --- | --- |
| FACULTY-BOUNDARY-01 | Evaluate whether the learner used the provided facts completely and consistently. | Present the fictional case answer as a scope decision for another environment. |
| FACULTY-BOUNDARY-02 | Require every claim to identify its source, subject, period, authority, and limitation. | Convert practitioner analysis into PCI SSC language or organizational policy. |
| FACULTY-BOUNDARY-03 | Grade traceability, reasoning, uncertainty, and internal consistency. | Grade a PCI DSS compliance result, SAQ eligibility decision, or compliance-accepting-entity determination. |
| FACULTY-BOUNDARY-04 | Use published PCI SSC material and clearly attributed practitioner methods as distinct teaching sources. | Imply endorsement, official training, accreditation, assessor qualification, or employment readiness. |
| FACULTY-BOUNDARY-05 | Ask students to propose authorized tests against fictional or explicitly sanctioned lab systems. | Authorize scanning, exploitation, provider testing, or access to systems the course does not own. |
| FACULTY-BOUNDARY-06 | Accept multiple defensible answers when the case facts support them and limitations remain explicit. | Hide a missing fact so that only the instructor's preferred answer can appear correct. |

# Five intervention cards

## FACULTY-INTERVENTION-01 · “The provider handles PCI.”

**Ask:** Which exact service activity does the provider perform, what remains with the customer, and which current source supports that boundary?

**Repair signal:** The learner replaces a provider slogan with a service-specific responsibility claim.

## FACULTY-INTERVENTION-02 · “It is out of scope.”

**Ask:** Show the relationship, the exclusion basis, the test or evidence, the responsible authority, and the fact that would reopen the conclusion.

**Repair signal:** The learner turns a label into a bounded, testable proposition.

## FACULTY-INTERVENTION-03 · “The screenshot proves it.”

**Ask:** What subject, source, population, clock, collector, method, sequence, and limitation travel with that image?

**Repair signal:** The learner distinguishes a usable capture from sufficient evidence.

## FACULTY-INTERVENTION-04 · “The penetration test passed.”

**Ask:** Which proposition, target population, material variants, environment, technique, exclusions, and retests did the methodology cover?

**Repair signal:** The learner evaluates the test design rather than repeating the report outcome.

## FACULTY-INTERVENTION-05 · “That is the correct answer.”

**Ask:** Which facts and authority make it correct here, what remains unresolved, and which changed fact would make it incorrect?

**Repair signal:** The learner can defend the answer without borrowing the instructor's authority.

## Program boundary

W/ Faculty is independent practitioner education and a public pilot. It is not PCI SSC guidance or official PCI SSC training. It is not an accredited curriculum, a certification program, an assessor qualification, an eligibility decision, a grading mandate, or a compliance result. It is not a PCI DSS assessment and does not substitute for assessor judgment, organizational policy, or compliance-accepting-entity direction. Use only fictional or explicitly sanitized environments. Never enter account data, credentials, provider secrets, client evidence, restricted architecture, student records, or targets the class is not authorized to test.