{
  "schema_version": "1.0",
  "lab_id": "WACK-GAP-HANDOFF-LAB-0001",
  "content_id": "WACK-CONTENT-0143",
  "name": "Gap Discovery Handoff Laboratory",
  "purpose": "Practice turning one uncomfortable assessment discovery into a bounded, attributable, retestable handoff that a cold reader can reconstruct.",
  "status": "derived-from-practitioner-reviewed-method",
  "source_digest": "sha256:9cbb89f67ab818ec6f2cae6a1591c7bccf89d19fd73fa1f13e6f9150a6b89e7e",
  "authority_classification": ["PRACTITIONER_METHOD", "AI_ASSISTED"],
  "boundary": "This is a fictional teaching record. It does not determine PCI DSS compliance, create a real finding, replace assessor judgment, prescribe remediation, or decide a compliance-accepting entity's response.",
  "case": {
    "id": "privileged-population-filter",
    "title": "The seven identities outside the filter",
    "assessment_period": "Fictional quarter ending 2026-09-30",
    "discovery_date": "2026-09-29",
    "assertion": "All 46 privileged identities in the defined production payment environment were reviewed during the quarter and every exception received accountable disposition.",
    "brief": "The assessor reconciles the privileged-identity inventory to the quarterly review record. The review ticket contains 39 human administrators. Seven privileged workload identities were excluded by a report filter that returned only user accounts.",
    "facts": [
      {
        "id": "GH-01",
        "at": "2026-07-01",
        "title": "Quarterly review criterion",
        "text": "The approved identity standard requires the quarterly review population to include human and non-human identities with privileged production capability.",
        "object": "basis",
        "why": "This is the organizational basis for the expected population. It is not proof that the activity occurred."
      },
      {
        "id": "GH-02",
        "at": "2026-09-24",
        "title": "Completed review ticket",
        "text": "Ticket IAM-2047 records review decisions for 39 human administrators and states that the complete privileged population was reviewed.",
        "object": "claim",
        "why": "The ticket contains the accountable assertion being challenged and identifies the population it claims to cover."
      },
      {
        "id": "GH-03",
        "at": "2026-09-29",
        "title": "Inventory reconciliation",
        "text": "The assessor joins the identity inventory to the review export and identifies 46 privileged identities: 39 human administrators and seven workload identities.",
        "object": "evidence",
        "why": "This names the performed procedure, compared records, and resulting population rather than merely announcing a gap."
      },
      {
        "id": "GH-04",
        "at": "2026-09-29",
        "title": "Observed filter condition",
        "text": "Inspection of the saved report configuration shows accountType=user. The filter excluded all seven privileged workload identities from the quarterly review population.",
        "object": "condition",
        "why": "This is the precise observed condition, including mechanism and affected count."
      },
      {
        "id": "GH-05",
        "at": "2026-09-29",
        "title": "Assessment consequence",
        "text": "The complete-population assertion is unsupported for the seven omitted identities and for the quarter-wide review claim. The observation does not by itself establish that every access control failed.",
        "object": "consequence",
        "why": "This bounds what changes in the assessment record and what the discovery does not establish."
      },
      {
        "id": "GH-06",
        "at": "2026-09-30",
        "title": "Accountable decision boundary",
        "text": "The assessed entity owns correction and its representation. The assessor owns evaluation and retest. The compliance-accepting entity retains program-treatment authority.",
        "object": "authority",
        "why": "This prevents the assessor from becoming the implementer, control owner, or compliance-accepting authority."
      },
      {
        "id": "GH-07",
        "at": "2026-09-30",
        "title": "Explicit non-claims",
        "text": "No conclusion has been reached about the appropriateness of any omitted permission, other review periods, unrelated identity populations, or the final report response.",
        "object": "non_claim",
        "why": "The non-claims stop one valid observation from silently expanding into unsupported conclusions."
      },
      {
        "id": "GH-08",
        "at": "2026-10-10",
        "title": "Correction and retest record",
        "text": "The owner removes the filter, reviews all 46 identities, dispositions one excessive workload permission, and supplies a new export. The assessor re-runs the population join and inspects the 46 decisions; the historical omission remains preserved.",
        "object": "closure",
        "why": "This separates completed correction and retest from the historical condition and states the work that supports closure."
      }
    ],
    "model_handoff": {
      "condition": "The September 29 population reconciliation found that accountType=user excluded seven privileged workload identities from ticket IAM-2047.",
      "claim": "The challenged assertion covers all 46 privileged identities in the defined production payment environment during the quarter ending September 30.",
      "basis": "The approved identity standard defines the quarterly population as human and non-human identities with privileged production capability.",
      "evidence": "The assessor compared the saved review export, report configuration, identity inventory, and ticket decisions; the joined population was 46 while the recorded review population was 39.",
      "consequence": "The complete-population quarterly assertion is unsupported for seven workload identities. This does not establish that every identity control failed or decide the final report response.",
      "authority": "The entity owns correction and representation; the assessor owns evaluation and retest; the compliance-accepting entity owns its program treatment.",
      "non_claim": "No conclusion was reached about omitted-permission appropriateness, other periods, unrelated populations, or the final assessment result.",
      "closure": "On October 10 the assessor verified a 46-identity review population, inspected all decisions and the one permission correction, and preserved the original quarterly omission in the assessment record."
    },
    "cold_reader_questions": [
      "Can I identify the exact assertion being challenged?",
      "Can I identify the affected subject, population, environment, and period?",
      "Can I distinguish the observed condition from the criterion and from the claim?",
      "Can I reconstruct the evidence sources and procedure that produced the discovery?",
      "Can I state the bounded assessment consequence without inventing a broader failure?",
      "Can I identify which decision belongs to the entity, assessor, and compliance-accepting authority?",
      "Can I see what the record explicitly does not claim?",
      "Can I reproduce the closure and retest work without erasing the historical condition?"
    ],
    "reopen_triggers": [
      "A new privileged identity type or source becomes part of the defined environment.",
      "The report filter, inventory join, review procedure, population owner, or period changes.",
      "A later occurrence omits an identity, lacks a disposition, or contradicts the recorded population.",
      "The assessed entity changes its assertion or the compliance-accepting entity supplies new direction."
    ]
  },
  "objects": [
    {"id": "condition", "label": "Observed condition", "prompt": "What exactly was encountered?", "symbol": "W/!"},
    {"id": "claim", "label": "Claim + subject", "prompt": "Which assertion, population, environment, and period are affected?", "symbol": "W/?"},
    {"id": "basis", "label": "Authority basis", "prompt": "What created the expected state?", "symbol": "W/"},
    {"id": "evidence", "label": "Evidence + procedure", "prompt": "What work produced the observation?", "symbol": "W/→"},
    {"id": "consequence", "label": "Bounded consequence", "prompt": "What changes now, and what does not?", "symbol": "W/×"},
    {"id": "authority", "label": "Authority + owner", "prompt": "Who decides, corrects, evaluates, and accepts?", "symbol": "W/↔"},
    {"id": "non_claim", "label": "Explicit non-claim", "prompt": "What has not been established?", "symbol": "W/…"},
    {"id": "closure", "label": "Closure + retest", "prompt": "What proves correction without rewriting history?", "symbol": "W/✓"}
  ],
  "workshop": {
    "duration": "35 minutes",
    "roles": ["Handoff builder", "Assessed-entity owner", "Assessor", "Cold reader", "Decision recorder"],
    "sequence": [
      "Read only the assertion, period, discovery date, and fictional brief.",
      "Classify each dated fact into one handoff object without discussing the model answer.",
      "Write one bounded consequence and at least two explicit non-claims.",
      "Reveal the model handoff and reconcile disagreements without expanding the fictional facts.",
      "Give the completed record to the cold reader and ask all eight reconstruction questions.",
      "Record the first failed cold-reader question as the next method or artifact improvement."
    ]
  }
}