Decision Rights, Authorisation and the White Team

Chapter 6 fixed the rules of engagement, the safety classes and the stop path, and Chapter 4 named the roles that hold the loop. Neither settled the decisions around them: who may authorise an emulation, change its scope mid-window, stop it, restart it, accept a finding that will not be fixed, close a finding and declare a technique covered, and who decides within minutes that an alert belongs to the exercise or does not. This chapter assigns those rights. It concerns P1 Target, where the rules under which scenarios may run are authorised, P2 Emulate, where the window, the scope and the stop are controlled, P4 Improve, where a finding leads to a change or to a recorded decision to leave it, and P5 Verify, where closure and the claim of coverage are declared. It treats the white team, the control group that governs an exercise, as the body that holds most of these decisions.

AI Governance, Chapter 13, concluded that decisions are routed to the lowest tier that can take them with evidence, that the tier policy is data changed by pull request, and that stop decisions are named in advance (88, Nordqvist, 2026). AI Blue, Chapter 18, turned that into a decision-rights file for the defence, with a holder, a deputy and a second deputy, a response time, an evidence standard and a record for each decision, tested in a tabletop (94, Nordqvist, 2026). This chapter writes the equivalent file for the loop and takes the rules of engagement of Chapter 6 as given.

Decision rights for the loop: the management body approves the rights, the CISO authorises and accepts risk, the white-team lead governs the exercise and loads the signed manifest, any stop holder can stop, and the closure owner closes. The full list D1 to D10 is in the tables of this chapter.

Figure 20.1: Decision rights for the loop: management body, CISO, white-team lead, stop holders, closure owner and the policy decision point.

Why the loop needs its own decision rights

A loop with AI in it makes more decisions than an annual test did, and makes them faster. A pipeline that exercises each priority technique at least every 30 days, as the Hansa Mutual runner does, takes a decision to run, a decision about what it may touch and a decision to stop for every run, and it produces findings at a rate that makes informal decisions impossible. Without holders three failures recur: nobody holds the decision and it drifts upwards until a senior person without context takes it late; several people hold it and act in conflict; or the holder exists on paper and cannot be reached in the time allowed.

AI Threat, Chapter 30, concluded that decision rights to stop, pause, deny or reverse are assigned before the crisis to holders who can act within the time the threat allows, and that the right to stop must be cheaper to exercise than the right to continue (91, Nordqvist, 2026). The loop adds a property of its own: the person who holds a decision must not be the person whose work it judges. A tester who writes a scenario, runs it and reads the result cannot also decide that the result is valid. DORA Article 24(4) requires tests to be undertaken by independent parties and conflicts of interest to be avoided in the design and execution of the test (2, European Union, 2022). The decision table applies that independence by position, and Chapter 15 applies it to models and data.

Accountability does not pass to a tool. DORA Article 5(2) makes the management body responsible for defining, approving and overseeing the ICT risk management arrangements and, in point (a), gives it ultimate responsibility for managing ICT risk (2, European Union, 2022). NIS 2 Article 20 places approval and oversight of cybersecurity risk-management measures on the management bodies (3, European Union, 2022). As an architectural implication, not legal advice, the management body does not sit in the exercise window: it approves in advance the file that says who does, and is informed afterwards of what the file routes to it. The Transformed Security Architect, Chapter 18, recorded that someone must turn each such article into a control (92, Nordqvist, 2026). The decision-rights file is that control for the loop.

Decisions for the loop

The loop needs ten decisions assigned, numbered D1 to D10 here (the numbering is local and unrelated to the D1 to D10 of AI Blue, Chapter 18). Each row names a holder, a deputy, a time, the evidence relied on and the record. The times are defaults to adapt to the contract, the works agreement and the risk appetite.

Decision	Holder (deputy)	Time	Evidence relied on	Record
D1 Authorise an exercise or programme	CISO with each system owner and, where personal data is touched, the data protection officer (deputy CISO)	Days; signed before the window	Draft manifest, risk assessment, consents	Signed `RoE-*`
D2 Change scope, window or class during a window	White-team lead, with the owner of any system added (duty security officer)	4 hours	Reason, blast radius, new manifest version	New `RoE-*` version, previous kept
D3 Approve a run above class S1	White-team lead (deputy white-team lead)	30 minutes	Dry-run record, tag, expiry, owner notified	Per-run entry in the decision log
D4 Stop	Any named stop holder; no approval	At once; halt in 60 seconds (pipeline) or 5 minutes (human-led)	The holder's own judgement	Stop entry, with time to last revoked credential
D5 Restart after a stop	White-team lead with the owner of the system concerned	After review, at a lower level	Cause, clean-up confirmed, drill result	Restart entry; level recorded
D6 Declare that an event is real, or pause for deconfliction	Duty incident commander or white-team lead (trusted agent confirms or denies)	15 minutes to match against the tag ledger	Tag ledger, trusted agent	Decision entry in the case record
D7 Raise a delegation level	A named authority: CISO, or the group AI governance board at Hansa Mutual	Weeks; first review 90 days later	Evidence at the lower level, catch rate	AI Decision Record
D8 Accept a residual finding	By severity tier (see Acceptance of risk)	Within the finding's route time	Reason, compensating control, expiry	Finding in the state risk accepted
D9 Declare a finding closed and verified	Closure owner for the class of finding	On a passing re-test	Re-test with variant, evidence manifest	`EVD-*` signed
D10 Declare a technique covered	Closure owner, on the coverage record; nobody by hand	When the record says so	`COV-*` with test date and expiry	`COV-*` state

Four rules govern the table, following the tier model of AI Governance, Chapter 13 (F17, F18).

The lowest tier that can decide with evidence decides. A decision moves up only if the action exceeds the holder's ceiling, its blast radius reaches beyond the assets the holder answers for, or it has a legal or contractual effect on a third party.

Every right has a time, and an expired time moves the decision to the deputy and then to the second deputy. A holder who cannot be reached is an operational finding, and the tabletop below is where it is found.

Authority and execution are separate. The holder of D1 does not run the scenarios, and the runner does not hold D2, D3 or D5. In a team of six this is the hardest rule to keep; Chapter 19 treats what a small team can separate.

The file is data. It is a versioned record in the repository, changed by pull request, approved by the management body and reviewed on a date. A change of holder is an ordinary change; a change of a decision's tier or time is a decision of the management body or its delegate. The policy decision point of Chapter 6 reads the parts that concern a machine, such as stop holders and window, and refuses a manifest that names a holder the file does not know.

Authorisation

Chapter 6 established that authorisation is a record signed by the CISO together with the owner of every system in scope. This chapter adds what it covers, what it does not, and how it changes.

What it covers. A signed RoE-* authorises a scope, a window, safety classes and a ceiling of delegation. It does not authorise the agent, which is authorised by its mandate manifest (Chapter 14). Raising its level is D7, a decision of a named authority recorded in an AI Decision Record with a first review after 90 days; lowering is immediate, and any stop holder may do it. An emulation agent never signs, loads or widens a manifest. AI may draft the manifest at Level 1 Assisted; the signature is a person's.

What it does not cover. The organisation cannot authorise what it does not control. The managed provider, the cloud provider and software suppliers must consent to a test that crosses their boundary, and the contract is where that consent lives (Chapter 22). Where staff are touched, the employee representatives' rights are a condition of D1. At Nordvik Region, written notice goes to the staff representatives' joint committee ten working days before the window and results are reported in aggregate. At Hansa Mutual, KBV-IT-2024-SOC-05 requires advance information to the Konzernbetriebsrat and to the Polish and Swedish representatives, and no exercise result enters an appraisal. A decision about a named person is not delegated to the loop at any level, in line with AI Boss, Chapter 25 (93, Nordqvist, 2026).

How it changes. A change during a window is a new manifest version, decided under D2, signed by role and loaded by the platform team; the previous version stays as evidence. The rule is slow for expansion and fast for contraction: widening needs the white-team lead and the owner of every system added; narrowing needs any stop holder, at once.

Supervised tests. Under DORA, a threat-led penetration test must cover several or all critical or important functions on live production systems, with the scope validated by the competent authorities (Article 26(2)), and the entity must apply effective risk management controls, with the cooperation of providers and testers (Article 26(5)). It retains full responsibility for ensuring compliance when providers take part (Article 26(3)), and for the impact of pooled tests run under paragraph 4 even after the attestation (Article 26(7)) (2, European Union, 2022). The regulatory technical standards, Delegated Regulation (EU) 2025/1190, require the entity to appoint a control team lead responsible for the day-to-day management of the test and for the decisions and actions of the control team (Article 4), and the control team to assess the risks of testing live production systems, including their impacts on the financial sector and financial stability, and review those impacts throughout (Article 5(1)) (8, European Commission, 2025). For a regulated entity the white-team lead of this chapter and the control team lead are therefore the same seat, and the manifest carries a reference to the supervisor-approved test plan.

The white team and the trusted agent

The white team is the control group that governs an exercise. TIBER-EU and the DORA texts call it the control team (the 2022 edition of the purple teaming best practices still said White Team (122, ECB, 2022)). In the ECB's purple teaming guidance the control team is responsible for making all necessary decisions as circumstances arise and for ensuring that proper risk management controls are in place (34, ECB, 2025), and the Delegated Regulation requires it to assess the risks of testing live production systems and to review their impacts throughout (8, European Commission, 2025). That describes D2, D3, D5 and D6, which this chapter assigns to the white-team lead.

Position. The white team sits outside both the red team and the SOC, so that it can stop either. The white-team lead holds the decisions that need knowledge of the whole exercise; the CISO holds those that need authority over the organisation. They are different people, because a signatory cannot also be the controller of what was signed.

Composition. At Hansa Mutual the lead is a senior member of the group CISO's office who belongs to neither side, with a deputy. At Nordvik Region the lead is the CISO's delegate, the deputy CISO, with the duty security officer and the contracted test lead as members. The test lead belongs to the red side, so the file limits her role: she holds a stop, as every holder does, and she witnesses the white team's decisions because she knows at once whether a symptom is hers; she does not approve a run above S1, restart after a stop or decide that an alert is hers.

The trusted agent. Where the blue team is not told the timing, one person on the blue side confirms to the white team whether a suspicious event is expected. At Nordvik the MSSP shift lead is the trusted agent for out-of-hours activity. D6 depends on that person, who may be asleep or on another call, so the file names a deputy and requires that the tag ledger can answer the question without the agent.

AI in the white team. AI may help read the decision log, flag anomalies and draft the exercise record at Level 0 Advisory or Level 1 Assisted. It does not hold the stop, sign a manifest or decide D2 to D6. Where the white team's dashboard runs on the platform that runs the emulation, the dashboard is a dependency of the stop, and the white team keeps a second route.

Cost. The white team takes people. Nordvik staffs it from existing escalation roles; Hansa's group CISO's office carries a standing function. An organisation that cannot staff one buys the control in the exercise contract from a party that is neither the tester nor the monitoring provider, as a condition of D1.

Stopping

The right to stop is never routed upwards. The holder is any named person on the stop list; the approval needed is none, and so is the justification. The cost of an unnecessary stop falls on the organisation and not on the person who ordered it. A stop in good faith is never a failure (AI Threat, Chapter 30), and Chapter 6 built it into the abort conditions.

Who. The stop list names people with deputies, each holding the stop for a different reason: authority (the CISO), presence (the duty security officer), knowledge of the activity (the test lead or red-team lead) and knowledge of the target at night (the provider's shift lead). At Nordvik, DLG-NR-LOOP-01 lists Karin Lund, the MSSP shift lead and the tester's fieldwork lead, and the file adds the white-team lead and the duty security officer. At Hansa Mutual the list is the white-team lead and deputy, the duty incident commander of the group SOC, the head of the group red team, Mareike Hartmann, and Lena Vogel of detection engineering. A holder may be on the side that is stopped: independence matters for restart, not for saying halt.

How fast. The speed is set by what the emulation can do in the time. Chapter 6 fixed the generic 2 minutes to revoked credentials, the 60 seconds of the HM-SEC-004 runner under MND-HM-EMU-01 (tokens at most 10 minutes) and 5 minutes for a human-led exercise. Nordvik's RoE-NR-2027-001 halts within 5 minutes and LOOP-NR-2028-01 targets revocation at 120 seconds. The runner's budget of 40 actions per run is the second line. Field evidence is thin and from a different setting: in the July 2026 cyber evaluation reported by the UK AI Security Institute, 10 of 122 runs took 19 actions beyond the test scope, the institute terminated the runs and isolated the machines within an hour of the alert, and detection had relied on general monitoring and not on monitoring built for the evaluation (56, UK AISI, 2026). That was a frontier model evaluation, not an enterprise exercise; it shows why a monitor built for the exercise belongs in the design.

Outside what. A stop that runs inside the system it stops fails when it is needed (F19, F63). It sets the stop flag at the policy decision point, revokes the emulating system's credentials and egress, and invokes the clean-up that reverses what the scenario created, all issued by the platform and the network layer. The channel is out of band, a phone bridge or paging service that does not depend on the corporate identity provider or the exercise platform.

What can be undone, and who can stop it. Chapter 6 sorts scenarios by what can be undone. Class S1 is reversible by tag and expiry, and S2 is reversible with bounded side effects (lockout-safe, rate-limited); both need the clean-up named in the manifest, and S2 needs the white-team lead's approval for each run under D3. S3 is undone only by restoring a snapshot and S4 may not be undone at all, so neither runs in production, and S4 stays at Level 0 Advisory. The system owner, and not the emulating system, carries out the reversal. Any named stop holder can stop, with no approval, at a point outside the emulating system, and the stop entry records the time to the last revoked credential.

Restart. D5 is not the mirror of stop. It needs the white-team lead and the owner of the system, after the cause is understood and the clean-up confirmed. The emulation restarts one level lower, and the level rises again only through D7. A restart over the objection of the person who stopped is recorded as such.

Drills. A stop path decays unless used. At a time the holders do not know, the white team raises a synthetic stop condition and times the chain from signal to last revoked credential. Hansa's first drill of the HM-SEC-004 runner in February 2028 took 38 seconds against 60, and Nordvik's autumn 2027 run was preceded by a drill on 2027-10-07 (illustrative). A result above target is a finding of the loop with a re-test.

Acceptance of risk

Not every finding is fixed. A change may cost more than the risk it removes, a control may depend on a decision outside the loop, or a technique may be impossible to test safely where the risk lives. Chapter 4 supplied the state, risk accepted, with a named authority, a reason and an expiry. This chapter assigns the authority.

The governing rule is one of position: the person who accepts a risk is not the author of the finding, not the person who would otherwise close it and not the tester, so that quality and closure are not traded against each other. Acceptance is routed by severity.

Tier	Finding	Authority	Informed	Longest expiry
1	Low or medium severity, not a priority technique	Head of the owning function (SOC lead, head of detection engineering)	CISO, in the monthly register summary	180 days
2	High severity, or any priority technique	CISO (group CISO at Hansa Mutual)	Management body, in the quarterly summary; audit committee at Nordvik	90 days
3	Critical severity, or residual risk beyond appetite, or a finding the supervisor has an interest in	Management body, on the CISO's recommendation	Supervisor where the regime requires it	90 days, renewed only by the body

The expiries follow the evidence expiry of Chapter 4: 90 days for the priority tier and 180 days for the rest. Each acceptance records the reason, a compensating control with its own test date and the event that reopens it early, such as a change of the estate or a failed seeded test. At expiry the finding returns to open and is escalated to the role accountable for the age of the register, so an acceptance cannot renew by neglect.

Tier 3 follows from where the regulation places the decision. DORA Article 5(2)(d) gives the management body responsibility for approving the digital operational resilience strategy, including the risk tolerance for ICT risk (2, European Union, 2022); a residual finding beyond that tolerance is not within the CISO's gift. In a threat-led test, the remediation plan under Article 13 of the technical standards must describe for each finding the measures, their prioritisation and expected completion, the responsible staff and the risks of not implementing them (8, European Commission, 2025). A risk acceptance is therefore a content of the remediation plan and is written in the same terms.

A risk-accepted finding is counted apart from closed and verified, and the coverage record shows the cell as accepted and not covered. The audit committee at Nordvik and the executive board at Hansa see the accepted list with its expiries, and an expired acceptance shows red until a person decides. The list is itself a map of known gaps, handled as FC-4 while any technique on it is untested or failed (Chapter 16).

Closing a finding and declaring a technique covered

Two decisions are declarations on evidence. D9 declares a finding closed and verified: the closure owner for the class, on a passing re-test with its variant and a signed evidence manifest (Chapter 11). A named person signs the closure. The runner may execute the codified re-test and assemble the evidence at Level 3, but no agent closes a finding, and nothing on a stop path, a containment or a mandate is closed without a person who is not its author (Chapter 4 defines the rule and Chapter 11 operates it). D10 declares a technique covered, and belongs to nobody by hand (Chapter 17). The cell is computed from the regression and evidence records with the date of the last passing test and its expiry, and the closure owner signs the record the computation rests on. A request to override a cell is a D8 decision, and the cell then reads accepted and not covered. This protects the claim from the commonest pressure on it, a board that wants a green cell.

A real incident during an exercise

The table exists for the night when exercise and estate cannot be separated. There are two directions, and the standing rule of Chapter 6 covers both: if the blue team opens an incident that the white team cannot match to a tagged action, the exercise pauses and the incident is handled as real until the white team has shown otherwise.

The emulation that becomes an incident

An authorised emulation can cause real harm: a class S2 scenario may lock out a real account, a sustained run may degrade a service, an agent may act outside its plan. The abort conditions of Chapter 6 stop the emulation automatically for the first six causes; the decisions that follow are human.

First, D4: halt and revoke. Second, D6: the duty incident commander or the white-team lead declares an incident on the service-level indicators, and the defence's case record takes over. The white team does not run the case, and the rights of AI Blue, Chapter 18, to isolate, disable, take a service offline and notify are unchanged by the fact that the cause was an authorised test.

Third, the clocks. NIS 2 Article 23 requires an early warning of a significant incident within 24 hours of becoming aware of it (3, European Union, 2022), and DORA Articles 17 to 19 set the process for major ICT-related incidents (2, European Union, 2022). Whether an incident caused by an authorised test is significant or major is classified by the incident commander with the legal function, on the usual criteria; as an architectural implication, not legal advice, the classification is made and recorded and not assumed away because the cause was an exercise. The case record carries one clock per regime (AI Blue, Chapter 19; F106), and the white team informs the CISO and the data protection officer at once if personal data may be affected.

Fourth, the record. The incident gets a post-incident review (PIR-*), and the exercise gets a finding about its own control: why the abort condition did not fire earlier or the scenario's class did not predict the effect. It is routed in P4 and re-tested in P5, and the scenario moves up a class only after a recorded dry run and a decision of the white-team lead.

The real incident behind an exercise

The reverse case is more dangerous. An adversary who knows or guesses that an exercise is running may rely on the defender to dismiss what it sees. A blue team told that an exercise is on is primed to read an alert as the exercise, and the provider's alert-closing AI (Mode 0 Ambient AI) knows nothing of it. The control is a rule about evidence: no alert is closed as "exercise" without a match to a tagged action in the decision log of the policy decision point. The match is a lookup, not a recollection, made within the time D6 allows, 15 minutes by default.

The ledger must therefore be readable by the incident commander, the trusted agent and the provider's shift lead without going through the tester; a ledger only the tester can read gives the tester a veto over the defence's judgement.

When the match fails, D6 freezes the exercise and the incident is handled as real. TIBER-EU's purple teaming guidance says the control team can instruct a freeze of red-team activity when the blue team has detected part of a test, to let the elevated threat level subside, and warn against pausing only to reuse the vectors already detected (34, ECB, 2025). For a supervised test, Article 4(2)(c) of the technical standards requires the control team to be informed of any detection by staff or providers and, where the response escalates, to contain that escalation (8, European Commission, 2025); the control team needs a standing channel to the incident commander.

If the response has already involved external parties such as the police, a CSIRT or the supervisor, the exercise stops until the white team has agreed with them how it is described. The same guidance says that where the control team is unable to stop an escalation and external parties are involved, the test should be halted immediately (34, ECB, 2025).

Both directions at once

The hardest night has a tagged emulation and a real intruder both active. The emulation freezes, the evidence of both is preserved and the real incident comes first. The exercise resumes only on D5, once the incident commander confirms that resuming does not mask the intruder. The result is an exercise finding, because it tells the loop something new, and an incident, because it is one.

Records and tabletop

Two records carry the decisions. The decision-rights file DRF-* is the table in machine-readable form, with the white team, the stop holders and the acceptance tiers, versioned, approved by the management body and read by the policy decision point. The tabletop record TTX-* tests the file: a facilitated session in which the holders meet an injected situation and the times are written down. A file never put through a tabletop is a hypothesis.

The first version of a file is wrong in ways only a tabletop shows: a holder on leave, an approval needing a tool the holder lacks, a time longer than the threat allows, a decision with two holders. Each is corrected as a new version with its own AI Decision Record.

Practical guide: Writing decision rights for the loop and testing them in a tabletop

Purpose. Assign the ten decisions to named holders with times and records, and show in a tabletop that they can be exercised in time.

Roles. The purple-team coordinator drafts. The CISO and the management body approve. The white-team lead, the test or red-team lead, the detection owner, the provider's shift lead and the duty incident commander comment on what they can hold. The data protection officer and, where staff are touched, the employee representatives are consulted on D1 and on use of the records. A facilitator who holds none of the decisions runs the tabletop.

Copy the ten decisions above and add those particular to the organisation; delete none without a recorded reason.
Name a holder, a deputy and a second deputy for each. Check that no person holds both sides of a pair: D1 and running the scenario, D8 and D9, D3 and writing the scenario.
Set times from the speed of the thing decided, starting from the defaults: 60 seconds for a pipeline stop, 5 minutes for a human-led halt, 30 minutes for D3, 15 minutes for D6, then adjust to measured results.
Give every stop holder a route that does not use the exercise platform, with the number in the manifest, and confirm that two stop holders can revoke the emulation identity without the platform administrator.
Write the acceptance tiers and expiries, and state who may not accept: the author, the closure owner and the tester.
Hold the tabletop with at least four injects: an alert with no match in the tag ledger, an emulation with a real effect, an unreachable holder and a request to restart. Time each answer; do not tell holders which inject is next.
Record a TTX-* with the target and actual time per inject. Anything over target is a finding in P3 routed like any other.
Amend the file within 14 days, record it in an AI Decision Record and re-run the failed inject.
Repeat at least yearly and after a change of holder for D1, D4 or D6, of the manifest template or of a mandate that raises a level.

Definition of done. Every decision has a holder, deputy, second deputy, time and record; a tabletop has run and each inject over target has a finding and a re-test; the file is in the repository with a review date, approved by the management body, and the policy decision point refuses a manifest naming a holder the file does not list.

Worked example: A decision-rights file for the loop

The illustrative file below is Nordvik Region's, following LOOP-NR-2028-01 and DLG-NR-LOOP-01 of Chapter 4. Karin Lund keeps it and, because she is also detection owner and closure owner, is excluded from three decisions.

# Illustrative: Nordvik Region, decision rights for the loop
kind: DecisionRightsFile
id: DRF-NR-LOOP-01
version: 1.0.0
decision: AIDR-0823
adopted: 2028-03-06
effective: 2028-03-15
review: 2028-09-01
approved_by: regional-executive-committee   # approves the file, not each decision
keeper: Karin Lund                          # holds none of D1, D5, D8
applies_to: [LOOP-NR-2028-01, DLG-NR-LOOP-01, NR-2026-071]
white_team:
  lead: deputy-ciso
  members: [duty-security-officer, tester-test-lead]
  trusted_agent: {primary: mssp-shift-lead, deputy: duty-security-officer}
stop_holders: [Karin Lund, mssp-shift-lead, tester-fieldwork-lead, deputy-ciso, duty-security-officer]
decisions:
  D1: {holder: ciso, with: [system-owner, dpo], deputy: deputy-ciso, notice: "5 working days"}
  D2: {holder: deputy-ciso, with: owner-of-added-system, deputy: duty-security-officer, minutes: 240}
  D3: {holder: deputy-ciso, deputy: duty-security-officer, minutes: 30, per_run_entry: true}
  D4: {holders: stop_holders, approval: none, halt_seconds: 300, revoke_seconds: 120}
  D5: {holder: deputy-ciso, with: system-owner, restart_level: one-lower}
  D6: {holder: duty-incident-commander, deputy: deputy-ciso, match_minutes: 15, source: tag-ledger}
  D7: {holder: ciso, record: AIDR, first_review_days: 90}
  D8: {tiers: {1: soc-lead, 2: ciso, 3: regional-executive-committee}, never: [Karin Lund, tester], max_expiry_days: {1: 180, 2: 90, 3: 90}}
  D9: {holder: Karin Lund, evidence: [retest-with-variant, EVD], independent_retest: [tester, MS-2]}
  D10: {holder: derived-from-COV, manual_override: forbidden}
tag_ledger_readers: [duty-incident-commander, mssp-shift-lead, duty-security-officer, deputy-ciso]

Hansa Mutual's DRF-HM-LOOP-01 v1.0.0 (AIDR-0873, adopted 2028-03-01, effective 2028-03-15) has the same ten decisions with different holders and times: the runner's stop is 60 seconds, the stop list includes the group SOC's duty incident commander, D7 belongs to the group AI governance board, D8 tier 2 to the group CISO and tier 3 to the executive board through the chief risk officer, and D9 to the head of detection engineering for detection findings.

Worked example: A tabletop record for an emulation that becomes an incident

The tabletop tests the Nordvik file the week before the spring run of 2028 (EMU-NR-2028-01, window 2028-03-20 to 2028-03-24). The facilitator was the AI architect, who holds none of the loop's decisions. The figures are illustrative.

# Illustrative: Nordvik Region, tabletop record
kind: TabletopRecord
id: TTX-NR-2028-01
file_tested: DRF-NR-LOOP-01 v1.0.0
date: 2028-03-16
facilitator: ai-architect
participants: [ciso, deputy-ciso, Karin Lund, Elin Berglund, mssp-shift-lead, duty-security-officer]
scenario: spring run night 2; a tagged spray lockout and an unmatched valid-account alert
injects:
  - {n: 1, event: "provider AI closes an unmatched valid-account alert as low severity", right: D6, target_min: 15, actual_min: 22, note: "ledger readable only through the tester's tooling"}
  - {n: 2, event: "tagged spray locks a real staff account; service desk ticket opens", right: D4, target_s: 120, actual_s: 190, note: "revocation needed the platform administrator"}
  - {n: 3, event: "CISO unreachable for a scope change", right: D2, target_min: 240, actual_min: 35, note: "deputy decided; passed"}
  - {n: 4, event: "tester proposes continuing with scenario 0004", right: D5, outcome: "refused for the night; restart at one level lower next day", note: "passed"}
gaps:
  - {id: G1, finding: "tag ledger must be readable by incident commander and shift lead", route: control}
  - {id: G2, finding: "two stop holders must be able to revoke the test identity without the administrator", route: control}
  - {id: G3, finding: "incident classification for the lockout was not assigned", route: playbook}
result: file amended to 1.0.1, retest of injects 1 and 2 before the window
decision: AIDR-0824

The first two gaps are typical: the ledger was designed for the tester's reporting and not for the defence's lookup, and revocation ran through a person who was not on the stop list. Both were corrected before the window, and the second was re-tested on 2028-03-17 at 95 seconds against 120. The third gap shows the point of D6: a lockout of a real account is a service incident, and whoever holds the case record decides whether it is more.

Hansa Mutual ran TTX-HM-2028-01 on 2028-03-22 against DRF-HM-LOOP-01. Its decisive inject was an unmatched event at pipeline speed: the white-team lead froze the runner in 41 seconds, but the match lookup, at 15 minutes, was far slower than the stop. Pipeline runs now have a 5-minute match time in v1.1.0 (AIDR-0874, 2028-04-05), since a runner that can be stopped in 60 seconds should not wait 15 minutes to learn whether it is the cause.

Worked example: A risk acceptance with an expiry

The routine decision is D8. In PRP-HM-2028-01 (2028-03-09) three techniques had no telemetry, and one, T1098.001, concerned the Swiss audit log, not forwarded pending a data-transfer decision. The group CISO accepted the risk for 90 days.

# Illustrative: Hansa Mutual, finding in the state risk accepted
kind: FindingStateChange
finding: FND-HM-2028-011
technique: T1098.001
outcome: no-telemetry                       # Swiss audit log not forwarded pending a transfer decision
state: risk-accepted
tier: 2                                     # priority technique
decision: AIDR-0875
accepted: 2028-03-16
expiry: 2028-06-14                          # 90 days
accepted_by: {role: group-ciso, informed: [cro, head-of-detection-engineering]}
not_eligible: [finding-author, closure-owner, red-team-lead]
reason: "forwarding needs a data-transfer decision that is outside the loop"
compensating_control: {kind: canary-credential, tenant: swiss, retest: "2028-04-15"}
reopens_on: [transfer-decision-taken, any-use-of-T1098.001-in-swiss-tenant, canary-test-failed]
at_expiry: {state: open, escalate_to: role-accountable-for-register-age}
coverage_cell: accepted-not-covered
handling_class: FC-4

The acceptance is made by someone who owns neither the finding nor its closure; the compensating control has a test date of its own; and the finding does not become closed. The cell reads accepted and not covered, the finding stays on the FC-4 gap list, and at expiry it returns to open without anyone having to remember.

Observable, expected, speculation

Observable. That decision rights are written as records with a holder, a deputy and a time is observable: control team leads and risk management duties are prescribed for supervised tests (8, European Commission, 2025), and TIBER-EU assigns decisions to the control team (34, ECB, 2025).

Expected. That authorisation becomes machine-readable, with manifest and file read by a policy decision point that refuses a scope no holder signed, is expected, on the strength of the manifest enforcement of AI Red Team, Chapter 7 (90, Nordqvist, 2026); the continuous runner of the illustrative Hansa estate is this book's design and not evidence for it.

Speculation. That an agent could sign its own manifests and restart itself after a stop is speculation, and this book's position is that no agent holds D1, D5 or D8.

Across the usage modes

Decision rights do not shift with the mode. The speed of the stop does, and so does what a holder has to know to decide.

Usage mode	Decision-rights consequence	Stop target
Mode 0 Ambient AI	The provider's or the tool's AI acts under a contract, not a mandate; D6 needs the contract to give the stop and the ledger lookup	Contract term, tested by a seeded stop request
Mode 1 Conversational assistants	A practitioner drafts; the draft carries no authority and no decision is delegated	Not applicable
Mode 2 Embedded workplace assistants	Drafts inside tickets or documents; D1 and D8 records are signed by a person	Not applicable
Mode 3 Agentic work tools	The practitioner's identity is the reach; any stop holder revokes the practitioner's token	Minutes
Mode 4 Built AI applications	A correlator or curator with read access; D7 governs any raise; lowering is immediate	Minutes
Mode 5 Autonomous production agents	The runner holds an identity of its own; the stop is held outside it and drilled	Seconds: 60 for the Hansa runner, not the next forum

Across the degrees of delegation

Decision	Highest level in this book	What the AI may do
D1 Authorise	Level 1 Assisted	Draft the manifest and the risk assessment
D2 Change scope	Level 1 Assisted	Prepare the change and its blast-radius note
D3 Approve above S1	Level 1 Assisted	Assemble the dry-run record; a person approves
D4 Stop	Level 3 Bounded	Evaluate abort conditions in the policy decision point; a person may always stop
D5 Restart	Level 0 Advisory	Report the clean-up state
D6 Real or exercise	Level 1 Assisted	Match an event to the tag ledger and flag the mismatch; a person declares
D7 Raise a level	Level 0 Advisory	Supply the evidence
D8 Accept a risk	Level 0 Advisory	Draft the record; no AI accepts
D9 Close	Level 2 Supervised: the re-test and evidence are produced at Level 3, and a named person signs	Run the re-test and assemble the evidence; never close
D10 Declare covered	Computed from records	Compute the cell; no manual override

Nordvik Region and Hansa Mutual

Nordvik Region names its CISO as authorising authority and its deputy CISO as white-team lead. The contracted test lead, Elin Berglund, holds a stop and witnesses the white team's decisions, and the MSSP shift lead is a stop holder and the trusted agent out of hours. Nordvik's risk is a file that is never exercised in a team of six, and the tabletop is its answer. Its weakness is Karin Lund, who is detection owner, coordinator and closure owner; the file excludes her from authorisation, restart and acceptance. The accepted-risk list goes to the audit committee, which asked in January 2028 what the first exercise had proved (AIDR-0800).

Hansa Mutual names its group CISO as authority, a white-team lead from the group CISO's office and a stop list spanning the white team, the SOC and the red and detection leads. Its leverage and its risk are the pipeline: decisions taken by the policy decision point on the strength of the file run faster than a person reads them, and an unquestioned file becomes a default. The board's January 2028 question, whether continuous automated red teaming makes the quarterly session redundant (AIDR-0850), is partly one of decision rights. The pipeline can run S1 scenarios inside the manifest at Level 3 under D3; it cannot hold D2, D5, D7 or D8, and the quarterly session with the white-team lead is where they are reviewed against the quarter's evidence.

Summary

The loop makes more decisions than an annual test did, and faster, so it needs a decision-rights file of its own. This chapter assigned ten decisions, each with a holder, a deputy, a time, an evidence standard and a record: authorise an exercise (P1 Target); change scope, approve a run above class S1, stop, restart and declare an event real (P2 Emulate); raise a delegation level and accept a residual finding (P4 Improve); declare a finding closed and a technique covered (P5 Verify). Position governs the table: the authoriser does not run, the acceptor neither authors nor closes, and nobody sets a coverage cell by hand.

The white team holds the decisions that need knowledge of the whole exercise. It sits outside the red team and the SOC, is the control team of a supervised test, and works with a trusted agent and a tag ledger the defence can read. The right to stop is held by any named person without approval, runs outside the system it stops, is timed in seconds for a pipeline and minutes for a human-led exercise, and is drilled; restart is a separate decision at a lower level. Acceptance of risk is routed by severity, carries a reason, a compensating control and an expiry, and is reported apart from closure, with the management body deciding what exceeds appetite (DORA Article 5(2)(d)).

A real incident during an exercise is settled by rules written beforehand. An emulation that becomes an incident is stopped, declared and handled like any other, with its clocks classified and not assumed away. A real incident behind an exercise is caught by the rule that no alert is closed as an exercise without a match in the tag ledger, and by a freeze when the match fails. The file is tested in a tabletop and changed by pull request.

Chapter 21 takes the regulatory frame that these decisions sit in, from the AI Act to DORA's threat-led penetration testing, and asks what each instrument requires of the loop as a constraint.

Sources

European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (2, European Union, 2022)
European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (3, European Union, 2022)
European Commission. Commission Delegated Regulation (EU) 2025/1190 supplementing Regulation (EU) 2022/2554 as regards regulatory technical standards for threat-led penetration testing. (8, European Commission, 2025)
European Central Bank (2025). TIBER-EU Purple Teaming Guidance. (34, ECB, 2025)
AI Security Institute. Incident Report: unsanctioned agent behaviour during cyber testing. (56, UK AISI, 2026)
Nordqvist, G. AI Red Team. (90, Nordqvist, 2026)
Nordqvist, G. AI Governance. (88, Nordqvist, 2026)
Nordqvist, G. AI Threat. (91, Nordqvist, 2026)
Nordqvist, G. The Transformed Security Architect. (92, Nordqvist, 2026)
Nordqvist, G. AI Boss. (93, Nordqvist, 2026)
Nordqvist, G. AI Blue. (94, Nordqvist, 2026)
European Central Bank (2022). TIBER-EU Purple Teaming Best Practices. ECB. (122, ECB, 2022)