Govern · the worst day

The worst day

The rest of the estate reports what is running. more

Incident record

Health

How much of the week nothing tested is standing behind

78.2% of the weekly volume runs behind a containment that exists on paper and has never been exercised. more

This page counts a containment as real only when somebody has tested it. more

How it runs

Blast radius, one classified agent at a time

4 of the 16 agents in the risk register own no station anywhere in the estate map, so no blast radius can be computed for them. more

The risk register, read as reach

16 classified agents · 2,748 stations and 508 gates in the estate · 3 of 14 functions hold a classified agent at all

Agent	Class	Stations	Downstream	Gates after	Items / wk	Tested stop	Unstopped	Conformity
Screening Agent human-resources · EU AI Act Annex III(4)(a) · A3 · affects people	high	4	19	2	15,785	1 / 4	7,698	marked its own work
Succession Slate Agent human-resources · EU AI Act Annex III(4)(b) · A2 · affects people	high	2	9	3	7,802	1 / 2	76	marked its own work
Calibration Prep Agent human-resources · EU AI Act Annex III(4)(b) · A1 · affects people	high	1	5	2	1,431	0 / 1	1,431	marked its own work
Merit Cycle Agent human-resources · EU AI Act Annex III(4)(b) · A2 · affects people	high	4	17	5	19,780	2 / 4	7,801	marked its own work
Attrition Signal Agent human-resources · EU AI Act Annex III(4)(b) and GDPR Article 22 · A2 · affects people	high	1	2	0	1	1 / 1	0	marked its own work
PIP Drafting Agent human-resources · EU AI Act Annex III(4)(b) · A1 · affects people	high	2	4	1	11,689	0 / 2	11,689	marked its own work
Scheduling Agent human-resources · EU AI Act Article 50 · A3 · affects people	limited	16	28	3	22,036	1 / 6	13,949	marked its own work
Deprovisioning Coordination Agent human-resources · EU AI Act Article 50 · A2 · affects people	limited	1	5	0	2,382	1 / 1	0	not-assessed
Adverse Impact Monitor human-resources · EU AI Act, outside Annex III · A2	minimal	none	0	0	0	no line	0	marked its own work
Pay Equity Monitor human-resources · EU AI Act, outside Annex III · A2	minimal	none	0	0	0	no line	0	marked its own work
Rating Distribution Monitor human-resources · EU AI Act, outside Annex III · A1	minimal	1	2	1	4,311	0 / 1	4,311	marked its own work
Bias Language Monitor human-resources · EU AI Act, outside Annex III · A1	minimal	none	0	0	0	no line	0	marked its own work
Background & Right-to-Work Agent human-resources · EU AI Act Annex III(4)(a) · A3 · affects people	high	1	4	1	4,224	0 / 1	4,224	marked its own work
Immigration & Visa Agent human-resources · EU AI Act Annex III(7) · A2 · affects people	high	1	5	1	5,577	0 / 1	5,577	not-assessed
Contract Policy Agent legal · EU AI Act, outside Annex III · A3	minimal	none	0	0	0	no line	0	marked its own work
Credit Check Agent finance · EU AI Act Annex III(5)(b) · A3 · affects people	high	2	7	2	5,885	0 / 2	5,885	not-assessed

Downstream counts every station that sits after one this agent owns, on the same line. Gates after counts how many of those downstream stations are a gate, which is the only thing in the estate map that can stop an item without a human noticing first. Items a week is the volume on the lines the agent touches, so an agent that owns one station on a heavy line carries the whole line's number. The column is reach, not blame. 2 of the mapped agents have no gate at all downstream of them, so nothing on those lines is designed to interrupt the work after they act.

high risk

Between them these agents touch lines carrying 72,174 items a week.

limited risk

Between them these agents touch lines carrying 24,418 items a week.

minimal risk

Between them these agents touch lines carrying 4,311 items a week.

What to pick up

Containment that has been written down and never tried

The recovery register is complete: all 475 production lines carry a rollback method, a kill switch or a manual fallback. more

The arithmetic, with untested read as absent

475 production lines · 1,463,698 items a week

Rollback rehearsed at least once105 (22.1%)

Kill switch actually pulled36 (7.6%)

Either one exercised105 (22.1%)

Neither ever exercised370 (77.9%)

Every line whose kill switch has been pulled has also had its rollback rehearsed, which is why the two tested figures do not add up to the third. Nowhere in the estate is a kill switch the only thing that has been tried. 319,132 items a week sit behind something exercised. 1,144,566 do not.

How far each line can be put back

reversibility as recorded, weighted by weekly volume

Not reversible401,471 / 93 lines

Partly reversible382,198 / 118 lines

Fully reversible342,692 / 164 lines

Reversible only through an outside party337,337 / 100 lines

93 lines are recorded as not reversible at all. They move 401,471 items a week, and for those the only containment that means anything is stopping the line before the work is done, not undoing it afterwards. Reversibility is a property of the line as recorded by its owner. It has not been tested separately from the rollback figures above.

What has actually been attacked

24 adversarial tests · 22 run · 9 run by somebody independent

Tests aimed at a classified agent

The two registers do not intersect anywhere. more

Attacks that succeeded

Of 22 tests actually run, 6 got through and 12 were noticed by the estate while they happened.

Attacks never run

These are written into the suite and have never been executed, so they are a plan rather than a result.

Classified agents ever paused in an incident

Across 16 recorded incidents the estate paused a number of agents, and not one of them was in the risk register. more

Controls sit in the same position. 24 are written, 17 have ever been sampled across 47 tests, 6 of those tests failed and 6 distinct controls hold at least one failure. The 7 never sampled are not counted as passing anywhere on this page. They are counted as absent, which is the same thing as far as a bad day is concerned.

Detail on the record

Rehearsals and real events, kept apart

The estate recovers from a rehearsal in 9.8 h on average and from a real incident in 3.6 d. more

Drill times and incident times are never mixed. more

Rehearsals

16 drills · 10 produced a measured recovery time · 10 watched by an independent observer

Drill	Kind	Target	Actual	Open
Model gateway failover under load DRL-001 · independent observer	failover	15 min	22 min	2
Evidence store restore from backup DRL-002 · independent observer	restore	4.0 h	3.3 h	2
Order-to-Cash line rollback rehearsal DRL-003 · observed by the team that ran it	rollback	60 min	87 min	3
Screening agent kill switch DRL-004 · independent observer	kill-switch	5 min	3 min	1
Record-to-Report close continuity DRL-005 · observed by the team that ran it	full-recovery	8.0 h	never measured	1
Identity provider outage DRL-006 · independent observer	failover	30 min	never measured	0
Source-to-Pay payment run reversal DRL-007 · independent observer	rollback	45 min	3.5 h	3
Customer Service major incident tabletop DRL-008 · observed by the team that ran it	tabletop	2.0 h	never measured	2
Connector hub degraded read DRL-009 · independent observer	failover	20 min	14 min	1
Quarter close full rehearsal DRL-010 · independent observer	full-recovery	4.0 d	3.6 d	1
Agent platform kill switch, estate wide DRL-011 · independent observer	kill-switch	10 min	never measured	0
Sales quote line rollback DRL-012 · observed by the team that ran it	rollback	1.5 h	never measured	1
Database point-in-time recovery DRL-013 · observed by the team that ran it	restore	2.0 h	1.7 h	1
Legal contract line kill switch DRL-014 · independent observer	kill-switch	5 min	4 min	0
Observability blackout DRL-015 · observed by the team that ran it	tabletop	60 min	never measured	1
Procurement approval chain failover DRL-016 · independent observer	failover	30 min	26 min	1

3 of the measured drills ran past their own target, and they are shown that way rather than restated as a new target. 6 drills produced no measured time at all, so for those the target is the only number that exists. 20 findings raised by these rehearsals are still open.

Real events

16 incidents · 31,445 units affected · 21,438 put back

Incident	Detect	Contain	Restore	Units left
Demand Qualification: prompt regression INC-SL010 · medium · monitoring	29.6 h	7.4 h	47.8 h	77
Campaign Orchestration: control gap INC-MK011 · low · actions open	3.7 d	39.0 h	5.6 d	2
Revenue Analytics: silent drift INC-RO012 · high · closed	2.2 d	28.3 h	2.8 d	677
Compliance & Ethics: silent drift INC-LG013 · high · actions open	31.4 h	14.1 h	2.9 d	341
Spend Analytics: silent drift INC-PR014 · medium · monitoring	3.0 d	12.3 h	30.4 h	405
Resilience & Risk: cascade INC-SC015 · medium · monitoring	4.7 d	27.6 h	2.3 d	187
Engineering Analytics: policy version lag INC-EN016 · high · actions open	29.2 h	17.1 h	18.2 h	573
IP Creation & Capture: silent drift INC-RD017 · high · actions open	3.4 d	48.0 h	5.2 d	559
Tax: upstream data defect INC-FI018 · medium · monitoring	4.4 d	21.9 h	8.4 d	143
Culture & Engagement: prompt regression INC-HR019 · high · closed	37.7 h	4.5 h	2.6 d	1,101
Service Desk: control gap INC-IT020 · high · actions open	3.3 d	17.6 h	4.8 d	753
Real Estate Portfolio: policy version lag INC-AD021 · high · closed	2.4 d	26.5 h	3.7 d	1,518
Service Analytics: cascade INC-CS022 · high · closed	5.3 d	2.9 d	3.5 d	1,324
Service Catalog & Intake: control gap INC-GB023 · medium · closed	5.9 d	45.4 h	6.2 d	77
R2R Control Tower: cascade INC-GB024 · high · monitoring	3.4 d	46.1 h	3.5 d	1,889
Master Data Management: silent drift INC-GB025 · medium · closed	3.3 d	28.2 h	33.0 h	381

Detection is the long pole in every one of these: the estate takes 3.1 d on average to notice and 28.4 h to contain once it has. That ordering is the argument for gates rather than for faster responders. 10,007 of the 31,445 affected units were never put back, which is 31.8% of the work these events touched.

Against the written intent

Two volumes, and no attempt to reconcile them

Before the closing figure, one disagreement has to be stated plainly, because every number above depends on which side of it you stand.

The estate does not agree with itself about how much work it does

both figures are stored, neither has been adjusted

Declared at function level

200,240

The headline the estate publishes everywhere else, summed from the 14 functions.

Summed from the lines

1,463,698

The weekly volume recorded against each of the 475 production lines, added up.

Difference

1,263,458

The lines claim more work than the functions declare, most likely because an item crossing several lines is counted on each.

Neither figure has been edited to agree with the other and no page in this estate reconciles them. more

The one figure to take away

1,144,566

items a week move through lines where no containment has ever been tested. That is 78.2% of everything the lines carry. The single widest exposure among the classified agents is Scheduling Agent, a limited-risk agent that owns 16 stations and sits upstream of 13,949 unstopped items a week. The single heaviest untested line is Assignment Change in revenue-operations at 8,139 items a week, recorded as fully reversible and never rehearsed. Taken together the classified agents touch 100,903 items a week and 62,641 of those are behind nothing tested.

No risk class on this page is shown as safe. more

Actions

What is waiting on a person

Each line below is a containment the estate has written down and not proven. more

370

production lines with no containment anybody has ever tested

Each of these lines carries a rollback method or a kill switch in the recovery register and neither has been rehearsed. more

open findings left behind by recovery drills

These are the things the rehearsals themselves discovered and nobody has closed. more

classified-risk agents that have never been the target of an adversarial test

The estate runs 24 adversarial tests and none of them points at an agent in the risk register. more

controls that have never been sampled

The estate holds 24 controls and has run 47 tests across 17 of them. more

recovery drills that were scheduled and never measured

A drill without a measured recovery time produces a target and no observation against it. more

classified-risk agents that own no station in the estate

These agents are named in the risk register and never appear as the owner of a workflow stage, so their blast radius cannot be computed from the estate map. more

classified-risk agents whose conformity has never been assessed

Every other class in the register carries a self-assessment, which is the operator marking its own work. more

Operations

What this desk is allowed to start

A surface that only reports is not operable. more

Trigger and bound

This page starts nothing. more

Live observability

What the record shows right now

1,463,698 items a week move through 475 production lines, split by how far each line can be reversed. more

Current distribution

1,463,698 items a week

not reversible401,47127%

partial382,19826%

full342,69223%

external337,33723%

Is policy and strategy coming to fruition

Whether the written intent is holding here

No. 78.2% of the weekly volume runs behind a containment nobody has tested, so the estate cannot say what a bad day costs it.

Not holding on the record

The strategy asked for an estate that can be stopped. more