The incident is only part of the story. I look at the handoff, the decision, and the evidence left behind.
Short introductions to the existing scenarios. Each source contains the fuller narrative and supporting work.
I examined stale authenticator behavior, recovery loops, and rollout controls using an Entra ID test environment. The scenario connects technical behavior to audit evidence, device baselines, and executive reporting.
Read the source scenarioA fictional OAuth trust failure exposes the gap between approving a vendor and governing its integrations. The brief proposes token reviews, explicit integration approval, and clearer vendor accountability.
Read the source scenarioA simulated credential incident examines what happens when responders act before checking the logs. The focus is evidence verification, accountable escalation, token lifecycle review, and custody of incident records.
Read the source scenarioThese are concise design briefs for developing scenarios. The situations and review questions below are proposed, not incident findings.
A contractor requests an urgent access reset. The handoff leaves unclear who verified identity and who owns the decision.
Examine how workload, training gaps, and ambiguous ownership make a weak process easy to follow.
Define the verification step, escalation owner, and evidence retained. Review the request record and approval trail before calling the control effective.
A critical service depends on a vendor whose own providers are only partly visible.
Follow the dependency beyond the first contract. Identify service criticality, concentration, and responsibility when an upstream service fails.
Build a compact due-diligence and evidence checklist covering dependencies, access, service continuity, and unresolved remediation.
A team wants to use an AI service with business data. The proposed benefit is clear; the data path and accountability need review.
Ask what data enters the service, who can access it, what requires human review, and who accepts the remaining risk.
Draft an intake and decision record with the use case, data classification, vendor responsibilities, approval, and review trigger.
The existing v0.1 playbook covers identity events, administrative changes, and vendor activity, with review cadence and escalation triggers. The next polish step is to make event ownership and retained evidence explicit for each trigger.