# W/ Founders — Facilitator Guide

**Session:** Launch Friday at Signal Cart  
**Duration:** 45 minutes  
**Outcome:** A bounded launch decision record, capability-state ledger, two-path boundary map, provider responsibility brief, first-transaction evidence runway, and explicit reopening triggers.

## Roles

- **Founder / decision owner** — State the launch decision, business pressure, and authority actually held.
- **Product or engineering owner** — Describe deployed behavior, identities, configuration, and change paths without relying on the pitch deck.
- **Security or operations owner** — Challenge unsupported exclusions, evidence gaps, provider assumptions, and operating readiness.
- **Cold recorder** — Preserve facts, decisions, limitations, owners, and reopening triggers without rescuing the group.

## Run of show

1. **5 minutes · Name the decision** — Write the exact decision requested, the deadline, who can make it, and what the room cannot conclude.
2. **7 minutes · Separate capability states** — Classify each payment-relevant capability as proposed, present, production-capable, or effective. Preserve disagreements.
3. **8 minutes · Trace two paths** — Map where payment data moves and what identities, code, public endpoints, providers, and deployment systems can influence its security.
4. **8 minutes · Assign retained work** — Separate provider performance from customer configuration, operation, evidence, testing, change, incident, and reporting responsibilities.
5. **7 minutes · Build the evidence runway** — Name what must exist before launch, at first transaction, after each occurrence, and only after an operating period.
6. **10 minutes · Inject change and decide** — Introduce the session-replay request, reopen affected facts and claims, then record one bounded decision with conditions, owners, limitations, and triggers.

## Facilitation rules

- Use only the fictional Signal Cart facts. Do not invite participants to disclose a real company architecture, provider tenant, customer, investor, or assessment.
- Do not explain the intended answer during the first pass. Record the first fracture in the material or sequence.
- Require facts and authority before conclusions. A founder title, provider badge, dashboard color, or planned remediation is not the missing evidence.
- Preserve minority uncertainty. Do not force consensus by hiding a material unknown in the decision notes.
- End with a business decision record, not a PCI DSS compliance result, SAQ choice, provider endorsement, or assessor conclusion.

## Success conditions

- [ ] A cold founder can separate proposed, present, production-capable, and effective behavior without facilitator correction.
- [ ] The group can reconstruct both the account-data path and the security-influence path from retained artifacts.
- [ ] Provider assurance is treated as evidence about exact services and activities—not as customer launch approval.
- [ ] The late change reopens the affected records before the group records a decision.
- [ ] Another reader can identify the decision owner, conditions, limitations, and reopening triggers without founder oral history.

## Anonymous pilot observation

| Session Date | Tested Surface | Audience Roles Present | First Fracture | Authority Overreach | Expected Move | Observed Move | Oral Rescue | Smallest Repair | Retest Condition | Decision Signal | Known Limitation |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|   |   |   |   |   |   |   |   |   |   |   |   |

## Boundary

W/ Founders is independent practitioner education using a fictional company and fictional facts. It is not PCI SSC guidance, not an assessment, not a compliance result, not an SAQ-selection or eligibility decision, not legal or investment advice, not launch approval, not provider certification or endorsement, and not direction from a compliance-accepting entity. It does not authorize testing. Never enter account data, credentials, provider secrets, client evidence, restricted architecture, customer information, investor information, or identifying startup facts.