Part 3 of 4 · 2 min read
Exercises
Easy
Easy 1: Run it (30 minutes)
Run python -m pytest -q and python run_all.py in code/mini-accountability.
Done when: you report which tampering a plain hash chain missed.
Hint
only the anchor catches truncation and a full rewrite.
Easy 2: Write a RACI (30 minutes)
Write a RACI for refunds above 100 by an agent.
Done when: one named role is accountable and one can stop the agent.
Easy 3: Classify incidents (30 minutes)
Classify five realistic incidents with severity.
Done when: you adjust one weight and explain the change.
Medium
Medium 1: Signed checkpoints (4 hours)
Sign the head every 100 entries with an asymmetric key.
Done when: a verifier with only the public key detects truncation back to an earlier checkpoint.
Hint
sign (length, head); the verifier checks the signature before comparing.
Medium 2: Alert fatigue (3 hours)
Add a false-page rate to the escalation simulation.
Done when: you show how a high rate lowers the acknowledgement probability and what you change.
Hint
model each page as ignored with a probability that grows with recent false pages.
Medium 3: Per-tool breaker (3 hours)
Scope the breaker per tool and per user.
Done when: one noisy user does not halt everyone, and an attack across many users still trips.
Hint
key the sliding window by (tool, user) and also keep a global count.
Hard
Hard 1: Game day (8 hours)
Run a synthetic incident on a real agent. (I did not run this, so your numbers are the ground truth.)
Done when: you report time to detect, acknowledge and stop, and one fix.
Hard 2: Audit query (6 hours)
Reconstruct a specific action from the audit log and traces. (I did not run this.)
Done when: you can answer who, what, when, which versions and who approved in under five minutes.
Hard 3: Immutable storage (8 hours)
Store the anchor in a write-once or separate-account store. (I did not run this.)
Done when: a test shows the log owner cannot alter the anchor.