Scenario Lab // Governance SIMs
Governance under pressure.
The incident is only part of the story. I look at the handoff, the decision, and the evidence left behind.
Available simulations
Short introductions to the existing scenarios. Each source contains the fuller narrative and supporting work.
MFA Ghost
I examined stale authenticator behavior, recovery loops, and rollout controls using an Entra ID test environment. The scenario connects technical behavior to audit evidence, device baselines, and executive reporting.
Read the source scenarioShiny Trust Breach
A fictional OAuth trust failure exposes the gap between approving a vendor and governing its integrations. The brief proposes token reviews, explicit integration approval, and clearer vendor accountability.
Read the source scenarioTrust Betrayal
A simulated credential incident examines what happens when responders act before checking the logs. The focus is evidence verification, accountable escalation, token lifecycle review, and custody of incident records.
Read the source scenarioOn the workbench
These are concise design briefs for developing scenarios. The situations and review questions below are proposed, not incident findings.
Human Failure Vector
A contractor requests an urgent access reset. The handoff leaves unclear who verified identity and who owns the decision.
Read the working brief
Review focus
Examine how workload, training gaps, and ambiguous ownership make a weak process easy to follow.
Next deliverable
Define the verification step, escalation owner, and evidence retained. Review the request record and approval trail before calling the control effective.
Third-Party Risk
A critical service depends on a vendor whose own providers are only partly visible.
Read the working brief
Review focus
Follow the dependency beyond the first contract. Identify service criticality, concentration, and responsibility when an upstream service fails.
Next deliverable
Build a compact due-diligence and evidence checklist covering dependencies, access, service continuity, and unresolved remediation.
AI Governance Decision
A team wants to use an AI service with business data. The proposed benefit is clear; the data path and accountability need review.
Read the working brief
Review focus
Ask what data enters the service, who can access it, what requires human review, and who accepts the remaining risk.
Next deliverable
Draft an intake and decision record with the use case, data classification, vendor responsibilities, approval, and review trigger.
Audit log playbook
The existing v0.1 playbook covers identity events, administrative changes, and vendor activity, with review cadence and escalation triggers. The next polish step is to make event ownership and retained evidence explicit for each trigger.