From vaults, a file in the seed packEverything on this sheet is the source site's own text; the newsroom's chrome is outside it.
{
"id": "RISK-114",
"start": "2026-09-01",
"title": "One risk, established, accepted, escalated, funded and ended on facts",
"lead": "An invented payments company, Kestrel Ledger, lets a deployment agent run database changes in production. The risk is that the agent can change the ledger, and that some of those changes cannot be reversed. Drag the slider to follow it for six weeks: who holds it, the clock on each acceptance, the evidence and controls, and the decision record. Underneath, compare what a typical register row shows at the same moment.",
"statement": "The deployment agent can change the production ledger, and some of its changes cannot be reversed.",
"chain": [
{
"role": "SRE lead",
"person": "Sam Osei"
},
{
"role": "Platform owner",
"person": "Priya Das"
},
{
"role": "CTO",
"person": "Tomasz Nowak"
},
{
"role": "CEO",
"person": "Ana Ruiz"
},
{
"role": "Board",
"person": "Kestrel Ledger board"
}
],
"facts": [
{
"id": "F-5",
"role": "establishes",
"text": "The deployment agent's database role can write to the production ledger.",
"source": "iam/roles/deploy-agent.json, as exported on 1 September"
},
{
"id": "F-7",
"role": "establishes",
"text": "Some ledger migrations cannot be rolled back.",
"source": "runbooks/ledger-migrations.md, section 4"
},
{
"id": "F-9",
"role": "context",
"text": "The agent's stop has never been tested.",
"source": "the on-call runbook has no stop test recorded"
},
{
"id": "F-11",
"role": "context",
"text": "On day 24 the agent applied a migration that could not be rolled back and stalled settlement.",
"source": "incident INC-2231 timeline"
},
{
"id": "F-12",
"role": "context",
"text": "The agent's stop was tested and took three minutes.",
"source": "stop-test record, day 40"
},
{
"id": "F-4",
"role": "ceases",
"text": "Every production write by the agent needs an approval step.",
"source": "pipeline/approvals.yml, merged on day 41"
},
{
"id": "F-3",
"role": "ceases",
"text": "The agent's database role is read-only on the ledger.",
"source": "would be iam/roles/deploy-agent.json; not chosen"
}
],
"controls": [
{
"id": "C-1",
"name": "Approval step on the agent's production writes",
"initial": "proposed",
"note": "Ends the risk on its own, through F-4."
},
{
"id": "C-2",
"name": "A tested stop for the agent",
"initial": "missing",
"note": "Does not end the risk; limits how long a bad change can run."
},
{
"id": "C-3",
"name": "Nightly ledger backup",
"initial": "in_place",
"note": "In place, and does not help: it cannot undo a migration mid-day without losing a day's transactions."
},
{
"id": "C-4",
"name": "Read-only role for the agent",
"initial": "proposed",
"note": "Would end the risk through F-3, but stops the agent doing its job. Not chosen."
}
],
"grc_initial": {
"Register row": "R-114, change risk in automated deployment",
"Owner": "Technology",
"Rating": "Medium",
"Status": "Open",
"Next review": "Risk committee, 12 December",
"Evidence": "none attached"
},
"events": [
{
"day": 0,
"type": "identified",
"label": "Established on two facts",
"actor": "Risk engineer",
"holder": "SRE lead",
"facts_add": [
"F-5",
"F-7",
"F-9"
],
"text": "The risk is written down with the facts that make it true, F-5 and F-7, each with its source, and the facts that would end it, F-4 or F-3.",
"seq": 1,
"prev": "0000000000000000000000000000000000000000000000000000000000000000",
"hash": "2633cf6c0c96b2e6df00302112a00fbcb5a356b91f71984587e67a4cc896b50b"
},
{
"day": 0,
"type": "placed",
"label": "Placed, and the chain computed",
"actor": "Risk engineer",
"text": "Held by the SRE lead. The platform owner, CTO, CEO and board now see it arrive through the chain, without anybody reporting it up.",
"seq": 2,
"prev": "2633cf6c0c96b2e6df00302112a00fbcb5a356b91f71984587e67a4cc896b50b",
"hash": "e17c56b92d9cc8410f45160099f5f6b16f1599f23a43e4ac0469e3af159b26ef"
},
{
"day": 1,
"type": "accepted",
"label": "Accepted for two weeks",
"actor": "Sam Osei",
"role": "SRE lead",
"rung": "1 to 2 weeks",
"days": 14,
"action": "The platform team adds an approval step to the agent's production writes.",
"text": "The SRE lead accepts personally, for two weeks: a funded project for a team that already exists.",
"seq": 3,
"prev": "e17c56b92d9cc8410f45160099f5f6b16f1599f23a43e4ac0469e3af159b26ef",
"hash": "3ad29eeb23413bfa2ce63149b9d9afcbb238038b1b89729566cce5dbe13ac3d3"
},
{
"day": 15,
"type": "expired",
"label": "The acceptance expires",
"actor": "the clock",
"text": "Two weeks pass. The approval step was not built: the team was moved onto a release. The acceptance ends and does not silently continue.",
"seq": 4,
"prev": "3ad29eeb23413bfa2ce63149b9d9afcbb238038b1b89729566cce5dbe13ac3d3",
"hash": "be49087b1958f2c1d00106ade8d0b8a2aa53a3dac11f049504be23a606a2fa11"
},
{
"day": 15,
"type": "escalated",
"label": "Escalated to the platform owner",
"actor": "the clock",
"role": "Platform owner",
"holder": "Platform owner",
"text": "Nobody renewed it, so it rolls up one level. The platform owner must accept, fund or fix.",
"seq": 5,
"prev": "be49087b1958f2c1d00106ade8d0b8a2aa53a3dac11f049504be23a606a2fa11",
"hash": "ba0a03fae1bf909e519786f5c197d0e36d2d06c43cc18a22c277b9f50e26ae6b"
},
{
"day": 16,
"type": "funded",
"label": "Funded: a four-week project",
"actor": "Priya Das",
"role": "Platform owner",
"controls": {
"C-1": "funded",
"C-2": "funded"
},
"text": "Project P-38: an approval step on the agent's production writes and a tested stop. £38,000 and four weeks, from outside the platform team's current work.",
"seq": 6,
"prev": "ba0a03fae1bf909e519786f5c197d0e36d2d06c43cc18a22c277b9f50e26ae6b",
"hash": "bdad18338ee8a22c0dfd8dc604b3b80841663062a77df329d396d86476570597"
},
{
"day": 16,
"type": "accepted",
"label": "Accepted for one month",
"actor": "Priya Das",
"role": "Platform owner",
"rung": "1 month",
"days": 30,
"action": "Project P-38 delivers the approval step and a tested stop.",
"text": "The platform owner accepts for a month, the default rung: assemble and fund. The project's length sets the interval.",
"seq": 7,
"prev": "bdad18338ee8a22c0dfd8dc604b3b80841663062a77df329d396d86476570597",
"hash": "ad58d84b79f395b1e8278084e26bd64fda66b8347a425f4478d82262605ba23e"
},
{
"day": 24,
"type": "incident",
"label": "Incident: an irreversible migration",
"actor": "on-call",
"facts_add": [
"F-11"
],
"grc": {
"Status": "Open (incident logged in the service desk, not linked)"
},
"text": "INC-2231. The agent applies a migration that cannot be rolled back, and settlement stalls. The risk has materialised.",
"seq": 8,
"prev": "ad58d84b79f395b1e8278084e26bd64fda66b8347a425f4478d82262605ba23e",
"hash": "0ffe19dc6d4791014b33d9637fa2074f5474ba97464b8cd19cd7c312f943a5f6"
},
{
"day": 24,
"type": "accepted",
"label": "Accepted for four hours",
"actor": "Priya Das",
"role": "Platform owner",
"rung": "4 hours",
"days": 0,
"action": "Suspend the agent's deploy job and reconcile the ledger.",
"status": "incident",
"text": "A four-hour acceptance is an incident response by definition. The agent is suspended and the ledger reconciled.",
"seq": 9,
"prev": "0ffe19dc6d4791014b33d9637fa2074f5474ba97464b8cd19cd7c312f943a5f6",
"hours": 4,
"hash": "5063ecd9615950bd556926340c66c7b1593b7243103053ce9918423d2c862551"
},
{
"day": 25,
"type": "accepted",
"label": "Back on the month's acceptance",
"actor": "Priya Das",
"role": "Platform owner",
"rung": "1 month",
"days": 21,
"action": "Project P-38 delivers, now with the incident as its evidence.",
"text": "The ledger is reconciled and the agent resumes under the funded project. The incident's timeline becomes a fact, F-11, in the risk's own record.",
"seq": 10,
"prev": "5063ecd9615950bd556926340c66c7b1593b7243103053ce9918423d2c862551",
"hash": "9a47941c21acd6e13cd9c458bd21a478254d1e27ef2d64a40ade65d5545f7068"
},
{
"day": 30,
"type": "reported",
"label": "In the board pack",
"actor": "Board",
"text": "The quarterly pack shows the risk arriving at the board with its chain, its acceptance, its incident and the project that will end it. Nobody wrote a paragraph about it.",
"seq": 11,
"prev": "9a47941c21acd6e13cd9c458bd21a478254d1e27ef2d64a40ade65d5545f7068",
"hash": "4940469fc9537af26cd5d11eb16b47945561564d0b2cfe67842c2fd3595fc824"
},
{
"day": 40,
"type": "evidence",
"label": "Stop tested",
"actor": "SRE lead",
"facts_add": [
"F-12"
],
"facts_remove": [
"F-9"
],
"controls": {
"C-2": "in_place"
},
"text": "The agent's stop is tested and takes three minutes. It does not end the risk, but it shortens how long a bad change can run.",
"seq": 12,
"prev": "4940469fc9537af26cd5d11eb16b47945561564d0b2cfe67842c2fd3595fc824",
"hash": "92043db8a91ae521c8603e12048c4c6556cdeac60601bbb770b871e68dd489d8"
},
{
"day": 41,
"type": "evidence",
"label": "Approval step merged",
"actor": "Platform team",
"facts_add": [
"F-4"
],
"controls": {
"C-1": "in_place"
},
"text": "Every production write by the agent now needs an approval. F-4 holds.",
"seq": 13,
"prev": "92043db8a91ae521c8603e12048c4c6556cdeac60601bbb770b871e68dd489d8",
"hash": "2e289693bb5e0464f8b56a6dfd5e6965a7dd39cc73714f43c17502a8a09bb99f"
},
{
"day": 42,
"type": "closed",
"label": "Ceased, on facts",
"actor": "Risk engineer",
"grc": {
"Status": "Open until the committee on 12 December"
},
"text": "F-4 holds, which is one of the facts the risk named as ending it. It ceases, with the evidence attached. In the register, it waits for the committee.",
"seq": 14,
"prev": "2e289693bb5e0464f8b56a6dfd5e6965a7dd39cc73714f43c17502a8a09bb99f",
"hash": "e58bf7cc494e923fec3c51ffb5b4ed63d5b3f03996904817daee08428cc4504e"
}
]
}