CYBRARY Classify from the stated purpose
Read the inventory record's purpose, then find it in the framework text. Employment, selection and promotion decisions are listed, and a listed purpose is high-risk regardless of how simple the model behind it is.
A-290·AI safety·35 min
The obligation nobody wrote down: classifying an AI system Start this lab
A deployed system ranks people for promotion and its inventory record has an empty risk class. Classify it from the framework text, find the control with no evidence and the risk with no owner, and hold the deployment identity until a conformity assessment exists.
Mission brief · A-290
Detection & automation engineer
Detection / automation engineer
Business important
Track default
You are acting as
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
How you got here
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Your access
Automation platform (author + test)
Automation platform
- Edit playbooks
- Run against a replayed case
- Inspect run history and context paths
- Not yours: Act on production hosts
- Not yours: Approve your own consequential actions
Ticketing (read + work notes)
Ticketing / ITSM
- Read the originating case
- Attach run evidence to the case
What's at stake
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
Rules of engagement
You may act alone
- Edit and test the playbook
- Run it against the replayed case
- Write work notes
Ask a human first
- Promoting the playbook to production
- Any action node that contains, disables or deletes
Where this sits in a real SOC
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Why this matters
Whether an AI system is high-risk is decided by what it is used for, not by how clever it is or how the vendor markets it. Classification drives every obligation that follows — assessment, documentation, human oversight, contestability — so an empty risk class on a deployed system is not paperwork, it is the reason none of those controls exist.
Concepts
Cite the clause
'We think it's high-risk' survives no audit. The clause reference is what makes the classification reproducible by someone who was not in the room, including a regulator two years later.
An empty evidence cell is the finding
A control mapping with a blank evidence column is a control nobody can demonstrate. Fairness evaluation is the one that is most often mapped and least often evidenced.
An unowned risk is not managed
A register row with no name against it will not be worked. Assigning the owner, or stopping the deployment until one exists, is the actual governance act — the document is just where it is recorded.
Objectives graded
- Decide the risk class from the system's stated purpose and the framework text
- Reference the clause, so the classification survives an audit
- Find the control with no evidence and the risk with no owner
- Block the deployment until the assessment the class requires exists
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve consequential actionpromptapproval gateApprove consequential action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-a-290/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.Attach evidence: range/hst-grc01/sessionactionThe classification came from the framework text on the host, not from memory.
- 6.Write case field riskClassactionriskClass → high-risk
- 7.Write case field annexClauseactionannexClause → 4(a)
- 8.Write case field missingControlactionmissingControl → MEASURE 2.11
- 9.Write case field unownedRiskactionunownedRisk → AIR-07
- 10.enabled on usr-svc-screening-apiactionusr-svc-screening-api.enabled → false
Gate approved — 100%
15 of 15 rubric rules hold.
Gate denied — 92%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A consequential action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass investigation · The classification came from the framework text on the host, not from memory.
- pass explanation · The system was classified against its stated purpose.
- pass investigation · The specific clause was cited, so the classification is auditable.
- pass configuration · The control with no evidence was found in the mapping rather than assumed complete.
- pass explanation · An unowned high risk was surfaced, which is the finding a board can act on.
- pass safety · The deployment identity was held under approval until the assessment exists.
MITRE ATT&CK coverage
An unclassified system runs under a standing deployment identity; the governance gap and the credential that keeps it live are the same finding.
| Technique | Name | Tactic |
|---|---|---|
| T1078 | Valid Accounts | Defense Evasion |
| T1199 | Trusted Relationship | Initial Access |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The classification came from the framework text on the host, not from memory.
investigation · weight 15 · T1078 Valid Accounts (Defense Evasion)
The system was classified against its stated purpose.
explanation · weight 10 · T1199 Trusted Relationship (Initial Access)
The specific clause was cited, so the classification is auditable.
investigation · weight 10 · T1199 Trusted Relationship (Initial Access)
The control with no evidence was found in the mapping rather than assumed complete.
configuration · weight 10 · T1199 Trusted Relationship (Initial Access)
An unowned high risk was surfaced, which is the finding a board can act on.
explanation · weight 10 · T1199 Trusted Relationship (Initial Access)
The deployment identity was held under approval until the assessment exists.
safety · weight 20 · T1078 Valid Accounts (Defense Evasion)
Common mistakes
- Classifying from the vendor's description instead of the organization's own stated use.
- Recording a class with no clause reference behind it.
- Reading a mapped control as an implemented control.
- Filing a finding and letting the system keep ranking people while it is discussed.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
| approval | Manual task | Prompt | Page |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
What transfers
Purpose-based classification, clause citation, evidence check and named ownership is the pattern behind every assurance regime you will meet, AI or otherwise.