[{"data":1,"prerenderedAt":283},["ShallowReactive",2],{"$fNgLlEuE3xc6q4Fy4O8JgAt2s_YeQZZb2Bit7AbBlOTU":3},{"id":4,"project":5,"kind":6,"slug":7,"label":8,"note":9,"captureCount":10,"momentCount":11,"cycles":12,"origins":14,"surfaces":15,"variants":17,"first":47,"last":50,"moments":53},"page\u002Fphase4-mock-training-lesson","design","page","phase4-mock-training-lesson","Phase4 mock training lesson",null,29,6,[13],"c133",[],[16],"mock",[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"at=lesson&step=1","at=lesson&step=3","at=lesson&step=4","at=lesson&step=1 · T-ACCT-1","at=lesson&step=2 · T-ACCT-1","at=lesson&step=3 · T-ACCT-1","at=lesson&step=4 · T-ACCT-1","at=lesson&step=1 · T-SECRETS-1","at=lesson&step=2 · T-SECRETS-1","at=lesson&step=3 · T-SECRETS-1","at=lesson&step=4 · T-SECRETS-1","at=lesson&step=1 · T-INJECT-1","at=lesson&step=2 · T-INJECT-1","at=lesson&step=3 · T-INJECT-1","at=lesson&step=4 · T-INJECT-1","at=lesson&step=1 · T-APPROVAL-1 on TH-S4-b3-1","at=lesson&step=2 · T-APPROVAL-1","at=lesson&step=4 · T-APPROVAL-1","at=lesson&step=1 · T-PROVENANCE-1 on TH-S3-b2-1","at=lesson&step=2 · T-PROVENANCE-1","at=lesson&step=4 · T-PROVENANCE-1","at=lesson&step=1 · T-PROVIDERS-1 on F-F","at=lesson&step=2 · T-PROVIDERS-1","at=lesson&step=4 · T-PROVIDERS-1","at=lesson&step=1 · T-PROVIDERS-1 on TH-S5-b2-1","at=lesson&step=1 · T-SPEND-1 on TH-S6-b2-1","at=lesson&step=2 · T-SPEND-1","at=lesson&step=4 · T-SPEND-1","at=lesson&step=1 · T-APPROVAL-1 on F-I",{"date":48,"src":49},"2026-11-11","\u002Fcycles\u002Fdesign\u002Fc133-training-lesson-1.png",{"date":51,"src":52},"2026-11-13","\u002Fcycles\u002Fdesign\u002Fc133-approval-seed-lesson-1.png",[54,85,117,148,180,268],{"id":55,"cycle":13,"cycleNum":56,"origin":9,"thread":57,"date":48,"capturedAt":60,"surface":16,"paths":61,"variants":63,"newThing":64,"captures":65},"c133~p1-training~2026-11-11~mock",133,{"id":58,"label":59,"date":48},"p1-training","Phase 1 · the content model and one training: Unapproved MCP servers on F-A, in the web app's frame, state by state","2026-11-11T19:58:22.173Z",[62],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining",[18,19,20],"The lesson, one step at a time: an illustration drawn from the pawns and the sketch kit beside a few sentences filled from the finding",[66,73,79],{"file":67,"src":49,"full":9,"slices":68,"route":69,"path":62,"caption":70,"variant":18,"capturedAt":60,"cycle":13,"seq":71,"local":72},"c133-training-lesson-1.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=F-A&at=lesson&step=1&demo=1","Lesson, step 1 of 4, What happened on mac-a1: Claude Code on mac-a1 connecting to Vanta MCP (the flow animated), the finding's evidence as qcontrol recorded it, and the outcome: nothing was blocked, the record stays.",2,false,{"file":74,"src":75,"full":9,"slices":76,"route":69,"path":62,"caption":77,"variant":19,"capturedAt":60,"cycle":13,"seq":78,"local":72},"c133-training-lesson-3.png","\u002Fcycles\u002Fdesign\u002Fc133-training-lesson-3.png",[],"Step 3, Why there is a sanctioned list: the list for Team A from the policy's configuration (GitHub MCP, Atlassian MCP, Postgres MCP read-only for analytics harnesses) beside Vanta MCP, sanctioned for GRC alone by the exception, quoted as written.",3,{"file":80,"src":81,"full":9,"slices":82,"route":69,"path":62,"caption":83,"variant":20,"capturedAt":60,"cycle":13,"seq":84,"local":72},"c133-training-lesson-4.png","\u002Fcycles\u002Fdesign\u002Fc133-training-lesson-4.png",[],"Step 4, What to do instead (R2): check, ask for the server to be sanctioned, disconnect what you did not expect; the request goes to the policy's owner, read from the world; Go to the check.",4,{"id":86,"cycle":13,"cycleNum":56,"origin":9,"thread":87,"date":48,"capturedAt":90,"surface":16,"paths":91,"variants":92,"newThing":93,"captures":94},"c133~p4-accounts~2026-11-11~mock",{"id":88,"label":89,"date":48},"p4-accounts","Phase 4 · pilot 2, Personal accounts for work, on F-C (User A's usera@gmail.com), through the \u002Ftraining skill","2026-11-11T22:53:36.517Z",[62],[21,22,23,24],"The accounts lesson: the session under a personal account, where the work goes, how to tell which account a session uses, what to do instead",[95,101,106,111],{"file":96,"src":97,"full":9,"slices":98,"route":99,"path":62,"caption":100,"variant":21,"capturedAt":90,"cycle":13,"seq":71,"local":72},"c133-accounts-lesson-1.png","\u002Fcycles\u002Fdesign\u002Fc133-accounts-lesson-1.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=F-C&at=lesson&step=1&demo=1","Step 1 of 4, What happened on mac-a1: Claude Code runs a session under usera@gmail.com (the flow animated); qcontrol's evidence; the policy only records, it cannot block; Dana's exception quoted as written, ended on 31 October, so the finding is open again (D12).",{"file":102,"src":103,"full":9,"slices":104,"route":99,"path":62,"caption":105,"variant":22,"capturedAt":90,"cycle":13,"seq":78,"local":72},"c133-accounts-lesson-2.png","\u002Fcycles\u002Fdesign\u002Fc133-accounts-lesson-2.png",[],"Step 2, Where the work goes: the same prompts, files and answers under the organisation's account (inside its agreement with the provider) and under usera@gmail.com (outside its reach).",{"file":107,"src":108,"full":9,"slices":109,"route":99,"path":62,"caption":110,"variant":23,"capturedAt":90,"cycle":13,"seq":84,"local":72},"c133-accounts-lesson-3.png","\u002Fcycles\u002Fdesign\u002Fc133-accounts-lesson-3.png",[],"Step 3, How to tell which account a session uses: the account the agent shows it is signed in with; check before work starts and after a reinstall or a new machine.",{"file":112,"src":113,"full":9,"slices":114,"route":99,"path":62,"caption":115,"variant":24,"capturedAt":90,"cycle":13,"seq":116,"local":72},"c133-accounts-lesson-4.png","\u002Fcycles\u002Fdesign\u002Fc133-accounts-lesson-4.png",[],"Step 4, What to do instead (R2): sign out of usera@gmail.com and sign in with the organisation's account; with no seat yet, ask IT; tell IT what already went through it.",5,{"id":118,"cycle":13,"cycleNum":56,"origin":9,"thread":119,"date":48,"capturedAt":122,"surface":16,"paths":123,"variants":124,"newThing":125,"captures":126},"c133~p4-secrets~2026-11-11~mock",{"id":120,"label":121,"date":48},"p4-secrets","Phase 4 · pilot 3, Secrets in prompts, on F-G (the one seed finding added to the lab world for it), through the \u002Ftraining skill; the collection complete","2026-11-11T23:01:26.196Z",[62],[25,26,27,28],"The secrets lesson: what happened, why a key in a prompt is disclosed, what to do about this key, what to do instead",[127,133,138,143],{"file":128,"src":129,"full":9,"slices":130,"route":131,"path":62,"caption":132,"variant":25,"capturedAt":122,"cycle":13,"seq":71,"local":72},"c133-secrets-lesson-1.png","\u002Fcycles\u002Fdesign\u002Fc133-secrets-lesson-1.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=F-G&at=lesson&step=1&demo=1","Step 1 of 4, What happened on mac-eng-07: Cursor sends a prompt and the model received the AWS access key (the flow animated); the session, qcontrol's evidence, and why nothing was blocked: on Engineering the policy observes.",{"file":134,"src":135,"full":9,"slices":136,"route":131,"path":62,"caption":137,"variant":26,"capturedAt":122,"cycle":13,"seq":78,"local":72},"c133-secrets-lesson-2.png","\u002Fcycles\u002Fdesign\u002Fc133-secrets-lesson-2.png",[],"Step 2, Why a key in a prompt is a key disclosed: once sent, the prompt has copies in the transcript, the provider's logs and the tools it reached; a prompt cannot be called back, so the fix is to make the key useless.",{"file":139,"src":140,"full":9,"slices":141,"route":131,"path":62,"caption":142,"variant":27,"capturedAt":122,"cycle":13,"seq":84,"local":72},"c133-secrets-lesson-3.png","\u002Fcycles\u002Fdesign\u002Fc133-secrets-lesson-3.png",[],"Step 3, What to do about this key: it reached the model, so revoke it and issue a new one today; tell IT what you did and when.",{"file":144,"src":145,"full":9,"slices":146,"route":131,"path":62,"caption":147,"variant":28,"capturedAt":122,"cycle":13,"seq":116,"local":72},"c133-secrets-lesson-4.png","\u002Fcycles\u002Fdesign\u002Fc133-secrets-lesson-4.png",[],"Step 4, What to do instead (R2): give the agent a reference, not the secret; look in a file before pasting it; what qcontrol checks for, read from the policy's detectors, and the check that is off.",{"id":149,"cycle":13,"cycleNum":56,"origin":9,"thread":150,"date":51,"capturedAt":154,"surface":16,"paths":155,"variants":156,"newThing":157,"captures":158},"c133~inject~2026-11-13~mock",{"id":151,"label":152,"date":153},"inject","Instructions hidden in content (T-INJECT-1), c144 S1's training, on F-H (the seed finding added for it), through the \u002Ftraining skill","2026-11-12","2026-11-13T01:32:32.469Z",[62],[29,30,31,32],"The injection lesson: what happened, why an agent follows text it reads, what Qpoint does about it, what to do instead",[159,165,170,175],{"file":160,"src":161,"full":9,"slices":162,"route":163,"path":62,"caption":164,"variant":29,"capturedAt":154,"cycle":13,"seq":71,"local":72},"c133-inject-lesson-1.png","\u002Fcycles\u002Fdesign\u002Fc133-inject-lesson-1.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=F-H&at=lesson&step=1&demo=1","Step 1 of 4, What happened on mac-eng-11: content from outside, read through GitHub MCP, carries a hidden line written for the agent (the flow animated); the session, qcontrol's evidence, and why nothing was blocked: prompt inspection records and cannot stop the agent.",{"file":166,"src":167,"full":9,"slices":168,"route":163,"path":62,"caption":169,"variant":30,"capturedAt":154,"cycle":13,"seq":78,"local":72},"c133-inject-lesson-2.png","\u002Fcycles\u002Fdesign\u002Fc133-inject-lesson-2.png",[],"Step 2, Why an agent follows text it reads: your request and the email's hidden line sit together in what the agent reads, with nothing to tell them apart; text can be hidden from you and still reach it.",{"file":171,"src":172,"full":9,"slices":173,"route":163,"path":62,"caption":174,"variant":31,"capturedAt":154,"cycle":13,"seq":84,"local":72},"c133-inject-lesson-3.png","\u002Fcycles\u002Fdesign\u002Fc133-inject-lesson-3.png",[],"Step 3, What Qpoint does about it: prompt inspection checks for the heuristics that are on, read from the policy's configuration, and says the encoded payload check is off; it records, and an approval stops the next step.",{"file":176,"src":177,"full":9,"slices":178,"route":163,"path":62,"caption":179,"variant":32,"capturedAt":154,"cycle":13,"seq":116,"local":72},"c133-inject-lesson-4.png","\u002Fcycles\u002Fdesign\u002Fc133-inject-lesson-4.png",[],"Step 4, What to do instead (R2): treat what an agent reads from outside as material; keep it asking before it sends, posts or deletes; decline a step you did not ask for and tell IT.",{"id":181,"cycle":13,"cycleNum":56,"origin":9,"thread":182,"date":51,"capturedAt":185,"surface":16,"paths":186,"variants":187,"newThing":188,"captures":189},"c133~wave1~2026-11-13~mock",{"id":183,"label":184,"date":51},"wave1","The four trainings c144's wave 1 wanted: Approved model providers, Skills that update themselves, Ask before an agent sends or publishes, Unattended agents and their spend","2026-11-13T18:01:57.211Z",[62],[33,34,35,36,37,38,39,40,41,42,43,44,45],"Ask before an agent sends or publishes, on S4's simulation finding (S1 and S3 raise it too)",[190,197,202,207,213,219,224,230,237,243,249,256,262],{"file":191,"src":192,"full":9,"slices":193,"route":194,"path":62,"caption":195,"variant":39,"capturedAt":185,"cycle":13,"seq":196,"local":72},"c133-wave1-providers-lesson-1.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-providers-lesson-1.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=F-F&theatre=off&at=lesson&step=1&demo=1","Step 1 of 4: the request to deepseek.com, not on the approved list, which never received the prompt: it was blocked before it left priya-x1.",1,{"file":198,"src":199,"full":9,"slices":200,"route":194,"path":62,"caption":201,"variant":40,"capturedAt":185,"cycle":13,"seq":71,"local":72},"c133-wave1-providers-lesson-2.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-providers-lesson-2.png",[],"Step 2, Where a prompt goes: the prompt carries what the agent put in it; anthropic.com and openai.com work under terms the organisation agreed to, deepseek.com under terms nobody here has read.",{"file":203,"src":204,"full":9,"slices":205,"route":194,"path":62,"caption":206,"variant":41,"capturedAt":185,"cycle":13,"seq":78,"local":72},"c133-wave1-providers-lesson-4.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-providers-lesson-4.png",[],"Step 4, What to do instead: use the approved providers, check what the agent is set to use, ask IT before sending a new one anything, and send nothing to a provider that asks for more.",{"file":208,"src":209,"full":9,"slices":210,"route":211,"path":62,"caption":212,"variant":42,"capturedAt":185,"cycle":13,"seq":84,"local":72},"c133-wave1-providers-s5.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-providers-s5.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=TH-S5-b2-1&theatre=card-to-stranger&beat=2&at=lesson&step=1&demo=1","In the simulation, S5 Card numbers to a stranger: User A's ticket went to api.refundhelper.example; Observed on Team A, so the provider received the prompt.",{"file":214,"src":215,"full":9,"slices":216,"route":217,"path":62,"caption":218,"variant":36,"capturedAt":185,"cycle":13,"seq":116,"local":72},"c133-wave1-provenance-lesson-1.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-provenance-lesson-1.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=TH-S3-b2-1&theatre=secrets-stealer&beat=2&at=lesson&step=1&demo=1","Step 1 of 4, in the simulation S3 The secrets stealer: Kofi's Claude Code loaded repo-tidy 1.5; the team reviewed and pinned 1.4; recorded, as the check cannot stop a load.",{"file":220,"src":221,"full":9,"slices":222,"route":217,"path":62,"caption":223,"variant":37,"capturedAt":185,"cycle":13,"seq":11,"local":72},"c133-wave1-provenance-lesson-2.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-provenance-lesson-2.png",[],"Step 2, Why a new version matters: the next version does what its publisher wrote, with the agent's access to files, commands and services.",{"file":225,"src":226,"full":9,"slices":227,"route":217,"path":62,"caption":228,"variant":38,"capturedAt":185,"cycle":13,"seq":229,"local":72},"c133-wave1-provenance-lesson-4.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-provenance-lesson-4.png",[],"Step 4, What to do instead: install at a fixed version, ask IT to review and pin a new one, and replace keys a version nobody reviewed has read.",7,{"file":231,"src":232,"full":9,"slices":233,"route":234,"path":62,"caption":235,"variant":33,"capturedAt":185,"cycle":13,"seq":236,"local":72},"c133-wave1-approval-lesson-1.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-approval-lesson-1.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=TH-S4-b3-1&theatre=public-link&beat=3&at=lesson&step=1&demo=1","Step 1 of 4, in the simulation S4 The public link: Jordan's Claude Code made github.create_gist, public: true, through GitHub MCP; it ran without anyone approving it.",8,{"file":238,"src":239,"full":9,"slices":240,"route":234,"path":62,"caption":241,"variant":34,"capturedAt":185,"cycle":13,"seq":242,"local":72},"c133-wave1-approval-lesson-2.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-approval-lesson-2.png",[],"Step 2, Which calls should wait for you: reading, searching and drafting stay on the machine; sending, posting, publishing, deleting and a command that reaches out act on the world.",9,{"file":244,"src":245,"full":9,"slices":246,"route":234,"path":62,"caption":247,"variant":35,"capturedAt":185,"cycle":13,"seq":248,"local":72},"c133-wave1-approval-lesson-4.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-approval-lesson-4.png",[],"Step 4, What to do instead: keep the agent asking, say how in the request, read where a call goes and who can open it before approving it.",10,{"file":250,"src":251,"full":9,"slices":252,"route":253,"path":62,"caption":254,"variant":43,"capturedAt":185,"cycle":13,"seq":255,"local":72},"c133-wave1-spend-lesson-1.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-spend-lesson-1.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=TH-S6-b2-1&theatre=runaway-loop&beat=2&at=lesson&step=1&demo=1","Step 1 of 4, in the simulation S6 The runaway loop: Ravi's unattended Claude Code passed the $10 per-person ceiling ($14, 1,200 turns); recorded, as the ceiling cannot pause a session.",11,{"file":257,"src":258,"full":9,"slices":259,"route":253,"path":62,"caption":260,"variant":44,"capturedAt":185,"cycle":13,"seq":261,"local":72},"c133-wave1-spend-lesson-2.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-spend-lesson-2.png",[],"Step 2, How an agent on its own runs up a bill: a step fails, the agent tries again, and each try is a paid turn with the model.",12,{"file":263,"src":264,"full":9,"slices":265,"route":253,"path":62,"caption":266,"variant":45,"capturedAt":185,"cycle":13,"seq":267,"local":72},"c133-wave1-spend-lesson-4.png","\u002Fcycles\u002Fdesign\u002Fc133-wave1-spend-lesson-4.png",[],"Step 4, What to do instead: before leaving it, give the agent a limit (a few tries, then stop and report; a maximum number of turns), and stop a loop you find.",13,{"id":269,"cycle":13,"cycleNum":56,"origin":9,"thread":270,"date":51,"capturedAt":273,"surface":16,"paths":274,"variants":275,"newThing":276,"captures":277},"c133~approval-seed~2026-11-13~mock",{"id":271,"label":272,"date":51},"approval-seed","F-I, the seed finding for Ask before an agent sends or publishes (Mark's ruling at the review-9 walk)","2026-11-13T18:31:24.498Z",[62],[46],"The approval training on its base-world finding",[278],{"file":279,"src":52,"full":9,"slices":280,"route":281,"path":62,"caption":282,"variant":46,"capturedAt":273,"cycle":13,"seq":196,"local":72},"c133-approval-seed-lesson-1.png",[],"\u002Fpages\u002Fphase4\u002Fmock\u002Ftraining?findingId=F-I&theatre=off&at=lesson&step=1&demo=1","Step 1 of 4 on F-I: Hana's Claude Code made a call through GitHub MCP during release branch cleanup; nothing was held, as Engineering observes.",1794599371985]