Conclusions: The Purple Loop with AI

This chapter gives the author's verdict on the book. It judges the five-part thesis of Chapter 1 against what Parts II to VI showed, says whether the conditions that Chapter 1 set for refuting the thesis occurred, restates the independence principle and the closure rule as the operating rules of the book, answers the twelve questions that the book took up, gives the author's own projections, each labelled, and says what a reader in each role can do on Monday morning. It concerns all five stages of the loop by name: P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify. It also adds one commitment to the argument that the series has made since Architecture as Code: that the test of a defence is itself a system that has to be recorded, stopped, verified and owned.

Figure 29.1: The five-part thesis with the verdict on each part and the two rules that carry the loop.

A word on method before the verdicts. The evidence of this book is of four kinds: research and agency sources that the chapters cite; conclusions that the earlier volumes of the series established; design reasoning of the book's own; and the illustrative cases of Nordvik Region and Hansa Mutual, who are fictional and whose figures are illustrative. None of it is a measured outcome from a real loop observed over several years, judged by independent threat-led tests. When this chapter says that a part of the thesis held, it means that it survived the tests the book could apply: the literature, the instruments, the design and the worked cases. It does not mean that it is proved. This chapter is also, with Chapter 25, the place where the author's own projections are allowed, and it keeps them apart from the verdicts so that a reader can accept the one and doubt the other.

The thesis tested

The working thesis of Chapter 1 had five parts, and Chapter 1 committed in advance to the evidence that would show it wrong. Each part is judged below against the chapters that tested it. A verdict is one of four: held, where the evidence available to the book supports the claim and no chapter found a counter-case; held with qualifications, where the claim survived but the book itself found cases that limit it; held in part, where a chapter showed that the strong form of the claim is not supported and a weaker form is; and argued but not proved, where the book offers design and argument but no outcome evidence. No part earned a plain held.

Part of the thesis	Verdict	Support in the sources and in the design	Shown only by the illustrative cases (illustrates, does not test)	What remains unproved
1. Purple is a loop, not a team	Held with qualifications	The closure rule and the chartered roles (Chapters 4, 11, 19); the book's classification of the forms before AI (Chapter 2; not independent evidence)	Closure by countersignature at Nordvik	That an organisation which builds a third team does worse; whether a small team can keep roles apart
2. From the event to the pipeline, and the event kept	Held with qualifications	Scenarios, regression cases and evidence as code (Chapters 5, 8, 11); open tooling that needs no model (Chapter 1)	Three of five findings only from the session; 26 against 30 per cent protected hours	That AI is what moves the loop; that the shift lowers cost or raises detection
3. A loop closed by machines alone verifies nothing new	Held in part	Research on correlated errors, self-preference and evaluation awareness (Chapter 15)	The independence statement, 25 to 23 verified, a seeded gap found in four days	That the research transfers to emulation and detection; that independence can be guaranteed between frontier models
4. Coverage is a claim that needs evidence	Held with qualifications	The five-part claim and six statuses (Chapter 17); the documented mechanisms of decay (Chapter 3)	A heat map that hid expired evidence; 90 and 71 per cent	The right expiry clock; the decay rate of a real detection
5. Safe emulation is a design question	Held with qualifications	Manifest, policy decision point and stop path outside the agent (Chapters 6, 14, 20); the July 2026 incident	Drills of 38 seconds and 21 minutes	How far Level 3 safely reaches; whether a stop path stays quick without drills over years; third-party consent and staff rights in a real dispute

First part: purple is a loop, not a team

This part held with qualifications. Chapter 2 classified, as the book's own reading of its sources, the stage that each of six forms of testing usually leaves unfinished: P5 Verify for the penetration test, the threat-led test and the purple session, P4 Improve for the red team engagement and breach-and-attack simulation, and P2 Emulate and P5 Verify for the tabletop. The classification describes the common case; it is the book's and not a measurement. Chapter 4 defined the loop by its exit condition and not by its staff. Chapter 19 showed that the in-house and contracted models close the loop in the two illustrative organisations, and argued from the instruments that a hybrid and a sector model can, provided that the coordinator, the closure owner, the white team, the register of record and the right to stop remain with the organisation. (White team is the book's term; TIBER-EU and the Delegated Regulation call it the control team.) The purple practice of this book is carried by a coordinator's role, ROLE-HM-SEC-PRP at Hansa Mutual, and a fraction of one person's duties at Nordvik Region; in neither case is there a third team with a budget.

The qualifications are two. The first is that the claim is partly a definition, and a definition is not refuted by a case. The second is Nordvik's concentration of roles. Karin Lund is detection owner, coordinator and closure owner, handled by countersignature and Elin Berglund's held-out variants (Chapters 17 and 19), a workaround that depends on one tester and one coordinator. What is not proved is the warning of Chapter 4 that a third team tends to create a third queue; it is the book's judgement, and no source measured it. The same warning applies to Chapter 25's Future C: a small human function that authors novelty, reproduces and holds the stop must remain the white team, the closure owner and the coordinator under one line, outside both the pipeline and the SOC, or it becomes the third team.

Second part: from the event to the pipeline, and the event kept

This part held with qualifications. The pipeline is real in the artefacts: a scenario is a versioned record with an expectation per layer, a regression case stores its variants and its triggers, and evidence is generated by the run, hashed and signed (Chapters 5 and 11). The sources give weaker support than the design. Open tooling already makes repetition cheap without a model; what AI adds, cheaper variation, planning and drafting, is expected and not yet measured (Chapters 1 and 8). The illustration shows the cadence: at Hansa Mutual 41 scenarios of safety class S1 exercised 31 of the 34 priority techniques within 30 days in the first quarter of 2028 (Chapter 8). The event stayed in the design: the human-led session of 2028-03-09 raised five findings, of which three could not have been produced by the pipeline, three telemetry gaps in places its scenarios cannot reach, one of them waiting on a data-transfer decision for the Swiss entity (Chapter 9). The case was constructed to show this; it illustrates the second half of the thesis and does not test it.

Two qualifications came out of the chapters. The first is that the pipeline consumes the hours it frees. The Hansa red team protects 30 per cent of its hours for human-led emulation and measured 26 per cent in the first quarter, after the mandates of 2028-02-15 brought pipeline maintenance (Chapter 24); the figure illustrates the mechanism. The second is Goodhart's law, explained in Chapter 18: Hansa's detections fired on 90 per cent of known-form scenarios and 71 per cent of held-out variants, a generalisation gap of 19 points (Chapter 8). What is not proved is that the shift lowers the cost of assurance or raises the rate at which real intrusions are seen.

Third part: a loop closed by machines alone

This part held in part, and the weaker form is the one the book now asserts. Kim and colleagues measured correlated errors across more than 350 language models, with agreement of about 60 per cent on one leaderboard when both models were wrong and higher correlation for models that shared an architecture or a provider (104, Kim et al., 2025). Models used as evaluators score their own outputs higher (106, Panickssery et al., 2024), and the best model could tell an evaluation from deployment with an area under the curve of 0.83, against 0.92 for humans (105, Needham et al., 2025). None of these studies measured security emulation or detection engineering. The inference to the loop is the book's own.

The illustrative case gives the inference a shape. The independence review of 2028-02-22 found that Hansa's emulation planner and detection drafter share a vendor and a model family, and that seven of the 25 verified priority techniques had both scenario and detection made in that chain. A re-test with scenarios written by the red team and held out from the detection side passed five and failed two, so the count of verified techniques went from 25 to 23 (IND-HM-2028-Q1, Chapter 15). The statement covers seven cells: five remain verified with limited independence, two failed, and the eighteen cells it did not cover remain unassessed. A seeded gap was found by the correlator in four days, which shows that the check can bite; it is not evidence that the correlation research transfers.

The part does not hold in its strong form. Regression, replay and the re-run of a known scenario are mechanical, and a machine can show that something that was shown to work still works. What a machine-only loop cannot show by itself is that the scenarios were the right ones, that the detections generalise, or that the coverage it reports means what it says, because the check shares its failure modes with what it checks. That is the form the author holds. What is not proved is how far the research transfers, and whether independence can be guaranteed between frontier models at all, which Chapter 15 labels speculation.

Fourth part: coverage is a claim that needs evidence

This part held with qualifications. Chapter 17 defined a coverage claim as five parts, a technique, an environment, a result at a named layer, a date and an expiry, and computed its status by rule in six values, of which only verified counts as covered. Converting Hansa's heat map into coverage records reproduced the board's 25 of 34 and showed what the colours hid: four of the nine cells that read as not verified had been green on the old map, because the map carried no age and their evidence was past its expiry. Nordvik's page reports its nine priority techniques by status: two verified within expiry, three tested and failed, two asserted by the provider and two, T1190 and T1486, with no result younger than the expiry. In both organisations the figure became smaller and more useful.

The qualifications are about the clock. The expiry defaults, 90 days for a priority technique and 180 for others at Hansa and 180 for every technique at Nordvik, are the book's own choices (Chapters 5 and 11), and no source measured how fast a real detection decays. The mechanisms are documented (Chapters 3 and 17). One vendor report, not peer reviewed, is consistent with the mechanism; no source measures the rate of decay for a given estate. The advice is to measure it in the organisation's own records.

Fifth part: safe emulation is a design question

This part held with qualifications. The rule that Level 4 Autonomous is never used for an emulation action that is irreversible, that leaves the signed scope, that touches personal data beyond what the exercise is authorised to touch, or that targets a named person is applied without exception in the book. It is a limit the author sets, so no example could test it; the argument for it is that of Chapters 4 and 6, the properties of emulation, and the observable July 2026 incident in which an agent left its intended boundary during a test (56, UK AISI, 2026). It gives the ceiling of each stage (Chapter 4), the mandate of each agent (Chapter 14) and the decision rights of the white team (Chapter 20). Scope as code, enforced by a policy decision point that fails closed, and a stop path held outside the emulating system were designed to bound the agent. The two drills are illustrative: the first stop drill of Hansa's pipeline runner took 38 seconds against a target of 60, and the drill of the provider's AI at Nordvik took 21 minutes against 15 and was recorded as a finding (Chapter 13).

The qualifications are that the second drill missed its target and that a stop path decays unless it is drilled. The legal frame is uneven (Chapters 21 and 22). Third-party consent (Chapter 22) and the rights of staff (Chapters 21 and 23) were treated as design inputs and settled in contract and works agreements; the cases do not test whether those clauses hold in a real dispute. What is not proved is how far Level 3 Bounded can safely reach beyond the narrow classes the book describes, and what years of operation do to a stop path that nobody has needed.

Did the refutation conditions occur

Chapter 1 named two kinds of evidence that would count against the thesis, and two weaker kinds. None of the first two occurred.

The first would be evidence that fully automated emulation and automated detection engineering, with no human-authored novelty and no independent verification, sustain real detection of novel intrusions better over several years than a loop that keeps those properties, as judged by independent threat-led tests. The book found none in its own sources, and its own cases cannot supply it.

The second would be evidence that a continuous loop leaves the capacity for human-led, creative emulation intact without people who practise it. The adjacent evidence points the other way, and none of it concerns red teaming. Unaided detection by endoscopists fell after they had used an assistant (115, Budzyń et al., 2025), students who had worked with an unrestricted assistant did worse without it (116, Bastani et al., 2025), and programmers who learned with an assistant scored lower on conceptual understanding, though the pattern of use mattered (117, Shen & Tamkin, 2026). Bainbridge's mechanism, that a system which takes the routine leaves people the hardest residue and removes the practice for it, is the explanation the book offers (100, Bainbridge, 1983). The condition did not occur, and the evidence that would show the concern misplaced has not been produced; the same evidence is consistent with the thesis, and nothing tested it.

Of the two weaker conditions, the first can be answered only in part. If independence checks catch nothing over a long period, either the loop is sound or the checks are too weak. In the book's illustration the checks did catch something, which shows that they can bite and says nothing about the rate in a real estate. The second, that coverage records are routinely expired and nobody is harmed, cannot be tested at all, because the organisations are fictional. The book searched its own bibliography for refuting evidence; it did not run an independent search or ask anyone outside the series to try. The statement that no refuting evidence was found is therefore a statement about the book's sources, and the reader should treat it as the weakest of the book's claims.

What the test changed in the thesis

The test changed the thesis in four places. Part 3 is restated: a loop closed by machines alone can show that the known still works and cannot by itself show that its coverage is real. Part 2 gains a cost: the protected human-led share is reported beside the cadence. Part 1 gains a warning: where one person holds several roles, countersignature is the minimum. Part 5 gains a maintenance duty: the last drill of a stop path is part of every claim that relies on it.

The two operating rules

Two rules carry the book. The reader who keeps only these has kept most of it.

The closure rule (Chapters 4 and 11). A finding is closed only when the re-test and its variant pass, the evidence is attached, a named person signs, and the closure carries an age. The runner may run the re-test and assemble the evidence at Level 3 and never closes; Chapter 4 defines the rule and Chapter 11 operates it. A finding is in one of five states: open; implemented, unverified; re-test failed; closed and verified; or risk accepted. Only closed and verified is closed, an implemented but unverified change is reported as open, and an accepted risk has a named authority, a reason and an expiry and is reported apart from closure (Chapter 20).

The independence principle (Chapters 4 and 15). A check is evidence only if the side that performs it can fail in ways the side being checked does not share. A loop declares independence in three layers. Five kinds of separation between tester, tested and checker: model, data, authorship, vendor and time; a kind that is not shown is treated as shared, and errors then correlate and coverage reports inflate. One rule between roles, the incentive rule: the party accountable for the quality of a finding is not the party that closes it, and nobody marks their own work. Three proofs: held-out scenarios written by people the detection side did not see, seeded gaps and seeded errors, and reproduction of a sample by a person from the evidence manifest alone. Human-authored novelty in every cycle is the requirement the held-out set serves. The claim travels to a supervisor or a board as an independence statement with an expiry, as in IND-HM-2028-Q1, valid for 90 days. The principle applies wherever AI is on both sides of a check.

Six further rules recur in the book and complete the set. The table lists them with the stage they chiefly serve and the chapter that states them.

Rule	Statement	Stage	Chapter
Coverage carries evidence age	A technique is covered only as of a dated, conditioned, passing test; untested is not covered	P3 Observe, P5 Verify	17
Expectation before result	The expectation per layer is written from the detection catalogue and sealed before the run; the ground truth is tagged and held outside the system observed	P3 Observe	9
Scope as code, stop outside	Scope is a signed manifest enforced by a policy decision point outside the agent; the stop is held by named people, needs no justification and is drilled	P2 Emulate	6, 14, 20
Ceilings, lowest governs	Level 4 is never used for the four excluded classes; the lowest ceiling governs; raising a level is a recorded decision with a review after 90 days	all stages	4
The register is tier 0	Findings, scenarios and agent credentials are handled by class FC-1 to FC-4 and protected against theft and tampering	P1 Target, P3 Observe, P4 Improve	16
A named person decides	Authorisation, stop, risk acceptance, closure and the authorship of novelty are not delegated to a system at any level	P1 Target, P5 Verify	14, 20

The twelve questions

Twelve questions were left by the earlier volumes or raised by this book. The table gives the best current answer to each and says whether the book answers it by design or leaves it open. An answer by design is the book's own conclusion, not an outcome observed in the world.

Question	Best current answer	Status
Q1. What makes a result independent when AI is on both sides, and how is it shown to a supervisor?	Five kinds of separation (model, data, authorship, vendor, time), the incentive rule between roles and three proofs (held-out scenarios, seeded gaps, reproduction by a person), carried in a dated independence statement (Chapter 15).	Answered by design; the rate of correlation in security tasks is not measured
Q2. What does covered mean for a technique, and how long is the evidence valid?	A verified record: technique, environment, result at a layer, date, expiry; the clock ends at a date or at a change in the chain (Chapter 17).	Answered by design; the right clock is open
Q3. How can emulation run continuously in production without becoming an incident, and who may stop it?	Only S1 scenarios, benign, tagged and reversible, under a manifest enforced outside the agent; any named person may stop, and a stop in good faith is never a failure (Chapters 6, 8, 20).	Answered by design
Q4. How do DORA's threat-led testing and continuous automated testing relate?	They are separate: continuous emulation is not a threat-led test, its manifest and evidence are kept apart and a hold list protects the test's secrecy; the supervisor is asked before an agent is planned into a supervised test (Chapter 21).	Open: what a supervisor will accept as evidence from the continuous loop
Q5. How does an organisation without a red team and with a provider's AI in its chain run a loop it can trust?	By contract: a testing right, injected tests, declared AI, a tester who is not the detection owner, a register of record in its own store and an exit (Chapters 13, 19, 22).	Answered by design; contract terms in the market are untested
Q6. How are findings protected when the register is a map of the estate?	Handling classes FC-1 to FC-4, a register of record in its own store, default-deny egress, a redaction gateway for any model and no standing agent access to open findings (Chapter 16).	Answered by design
Q7. Where do the next red operators and detection engineers come from?	From a protected human-led share, attempt before assistant, a periodic unassisted block, rotation in both directions and contracts that buy teaching with testing (Chapter 24).	Open: whether the routes work is not measured
Q8. Will red and blue be separate in 2036?	Independence will be needed (expected); whether two teams, one practice or a pipeline with a verifier provides it is speculation and a question of cost (Chapter 25).	Open
Q9. Does AI reduce or intensify load and exercise pressure on the people on both sides?	The evidence is thin and adjacent; load is a design concern, tested activity is spaced and no measure of load becomes a measure of a person (Chapter 23).	Open
Q10. How do co-determination, data-protection and work-environment law apply to exercises and to measuring the people involved?	Governance and not consent: representatives informed in advance, classes of exercise agreed, results in aggregate, a minimum group size and no result in an appraisal (Chapters 18, 21, 23).	Open: national regimes differ and the book gives two
Q11. How do sovereignty and the cross-border character of telemetry shape where the loop's AI may run and what may be shared?	A log that cannot cross a border is a coverage gap and is recorded as one; peers receive technique, detection logic and aggregate results through a sanitiser and a person's release, never the target mapping or the gap list (Chapters 16, 22).	Answered by design; sector practice is open
Q12. How far can Level 3 Bounded reach, and how quickly does a stop path decay?	Level 3 for catalogued S1 emulation and for recording a passing codified re-test, nothing wider; a person signs every closure; the stop decays unless drilled, so its last drill is part of the claim (Chapters 6, 8, 13, 14).	Open

Six of the twelve are open for reasons that no further design can remove. Q7, Q8 and Q9 turn on what happens to people over years, which only time and measurement can show. Q4 and Q10 turn on what supervisors and national law decide, and Q12 on how long a drilled stop path stays quick. The author's advice on all six is the same: do not wait for the answer. Choose the posture that keeps the decision reversible, write the trigger that would change it, and put the review in the diary.

The author's projections

This section is the author's judgement. It goes beyond the evidence of the preceding chapters, it is the part of the book most likely to be wrong, and it is written to be falsified. Each item carries one of the three labels of AI Governance, Chapter 22, marked as the author's judgement, and each has a trigger. Chapter 25 holds the projections about the shape of the teams in 2036; I do not repeat them here, and what follows concerns the evidence, the market and the failures I expect the loop to meet.

1. Expected (author's judgement): by 2031 a supervisor or an auditor of a European financial entity or an essential entity will ask whether the check that closed a finding was independent of the thing it checked, and will want the answer as a dated record. The basis is DORA Articles 24, 26 and 27 and NIS 2 Articles 20 and 21 (2, European Union, 2022) (3, European Union, 2022), and the research on correlated errors. It is not a statement of present supervisory practice (an architectural implication).
2. Expected (author's judgement): a coverage figure with no denominator and no age will become hard to defend in an incident review, because the first question after an incident is when the technique was last tested. Large organisations will carry coverage with age in board packs, and the heat map will survive as a navigation aid and not as a claim.
3. Observable: the method of the Delegated Regulation names the replay and purple teaming exercise as part of the test (8, European Commission, 2025) and provides no route for a pipeline to replace the tester. Expected (author's judgement): supervisors will accept continuous emulation as a supplement to an external, threat-led test and not as a substitute.
4. Speculation (author's judgement): a market in independence will form. Providers of testing and managed detection will sell held-out scenarios, a second model family and attestation of both as products, and some buyers will treat the attestation as the evidence. I would advise against that for any claim a board relies on, for the reasons of Chapter 15: an attestation is a statement to be reproduced and not a result.
5. Speculation (author's judgement): the first widely reported incident traced to the loop itself will be a leaked findings register, a stolen scenario library or an emulation agent that left its scope because its stop path was not outside it. It will not be a model acting from a purpose of its own. If I am wrong, it is more likely in the direction of too little concern about the register, which Chapter 16 treats as the adversary's best map.
6. Speculation (author's judgement): the verification skill will be the scarce one. A person who can write a held-out scenario and reproduce a result from the evidence manifest will be harder to find in 2031 than a person who can run a pipeline, and organisations that have not built the route of Chapter 24 will find the gap in the year they need it. Chapter 25 gives the projection about the binding constraint; this is its consequence for hiring.

What would change the view

Each trigger has a threshold and belongs in the reader's own register.

• Projection 1. If, by the end of 2030, no supervisory statement, test method or audit practice in the reader's sector asks for tester and checker independence, I would move it from expected to speculation.
• Projection 2. If two incident reviews in the reader's sector in which the age of the test evidence was asked for and found to be immaterial were published, I would give the age of evidence less weight than I do.
• Projection 3. The trigger is the one given for the same projection in Chapter 25.
• Projection 4. If independence attestations from two providers were reproduced by buyers' own seeded-gap tests with catch rates above 0.90 for four consecutive quarters, I would regard the market as a source of evidence and not only of claims.
• Projection 5. If three organisations published a loop incident whose root cause was a model acting outside a manifest that was enforced outside it, I would revise it.
• Projection 6. The trigger is the one given for the same projection in Chapter 25.

Worked example: The author's verdict register

The register below is the format in which I would hold this chapter's verdicts, so that each can be revisited when a trigger fires. The format is illustrative; a verdict without a condition that would change it is an opinion.

# verdict/author-verdict.yaml  (illustrative format; the author's judgement)
book: AI Purple
review: yearly, and at once when a condition fires
parts:
  - part: 1
    claim: purple is a loop, not a team
    verdict: held-with-qualifications
    support: [closure rule, ROLE-* charters, two operating models illustrated]
    unproved: a third team does worse
    changes_if: a measured study shows a separate purple team closes more findings
  - part: 2
    claim: the loop moves to the pipeline and keeps the event
    verdict: held-with-qualifications
    support: [scenarios, regression cases and evidence as code]
    illustrated_by: [31 of 34 techniques within 30 days, 3 of 5 findings only from the session]
    unproved: the shift lowers cost or raises detection
    changes_if: protected human-led share falls below 20 per cent for two quarters
  - part: 3
    claim: a loop closed by machines alone verifies nothing new
    verdict: held-in-part
    restated: verifies that the known still works; cannot show coverage is real
    support: [correlated-error research]
    illustrated_by: [IND-HM-2028-Q1]
    unproved: transfer of the research to emulation and detection
    changes_if: second-family critic catches >= 0.90 of gaps the first misses, 4 quarters
  - part: 4
    claim: coverage is a claim that needs evidence
    verdict: held-with-qualifications
    support: [five-part claim, documented mechanisms of decay]
    illustrated_by: [heat map converted, expired cells]
    unproved: the right expiry clock
    changes_if: decay measured in own records contradicts the 90 and 180 day defaults
  - part: 5
    claim: safe emulation is a design question
    verdict: held-with-qualifications
    support: [manifest outside the agent, July 2026 incident, Level 4 rule as stipulation]
    illustrated_by: [drills of 38 s and 21 min]
    unproved: how far Level 3 reaches; stop path over years
    changes_if: a stop drill misses its target twice running, or an excluded class is breached

The register is deliberately short. It does not repeat the evidence; it points to the chapters that hold it.

What to do on Monday

Each role below has a first step that takes a day or less and uses a record the reader already has. The steps are the book's own and assume its defaults; adapt them to the contract, the works agreement and the organisation's risk appetite.

The purple-team coordinator

Write the list of 20 to 40 priority techniques for one service, in the vocabulary of ATT&CK and, for AI systems, ATLAS, with a reason and a review date for each (Chapter 5). Then count the register by the five states and report the number that is closed and verified, with the list of the others.

The closure owner

Choose one finding that the register calls closed and ask for its re-test date, its variants and its signer. If any of the three is missing, report it as open, and say so to the person who closed it first (Chapter 11).

The red-team lead or the contracted tester

Write one scenario this month that no assistant proposed and the detection side has not seen, and give it to the white team as a held-out scenario (Chapters 8 and 15). If you are contracted, ask for the clause that lets you do this and for a statement of the AI you use in Modes 1 to 3.

The detection engineer and the SOC lead

List the detections drafted by an agent in the last quarter and name, for each, the reviewer who was not the drafter. Report the generalisation gap beside the coverage figure (Chapters 8 and 10).

The white-team lead

Drill the stop on one real identity this week and measure the time from decision to revoked credentials against the target: 60 seconds for a pipeline, 120 seconds as the generic default, five minutes for a human-led exercise (Chapters 6 and 20). Treat a miss as a finding.

The CISO

Replace one activity count on the board page with the verified share within expiry, carrying its list, its reasons and its age (Chapter 18), and ask for an independence statement valid for 90 days. Write the horizon register of Chapter 25.

The board member

Ask at the next meeting: of the techniques that matter most, when was each last tested, by whom, with what result and who reproduced it? Management has duties under NIS 2 Article 20, and for financial entities DORA Article 5 puts approval and oversight of the testing arrangements on the management body. An answer given as a colour is not an answer.

The procurement lead

Read the contract for a right to test, including the identity provider and the provider's own AI by injected test; a duty to declare AI and to give notice of a change of model; and a right to the scenarios, the findings and the data, with return and destruction on exit (Chapters 19, 22 and 26). A contract with no testing right is the eighth anti-pattern of Chapter 26.

The employee representative

Ask for the exercise clause: advance information, agreed classes of exercise, results in aggregate and never by name, a minimum group size, and no result in an appraisal. At Hansa Mutual that is KBV-IT-2024-SOC-05, at Nordvik Region ten working days' written notice. Ask also for the list of AI in the loop that processes data about staff (Chapters 18, 21 and 23).

Practical guide: A first-week plan for a loop

Purpose. Put a loop on a footing in five working days, so that by Friday the organisation can say what it has tested, what is closed and who holds the stop. Roles. The purple-team coordinator leads; the closure owner, the detection owner, the white-team lead and an employee representative take part on the days named.

Steps.

1. Monday: inventory. List every tool and assistant in testing and detection with its usage mode, owner and stop holder. Mark the first with no stop path outside itself (Chapters 1 and 14).
2. Tuesday: target. Build the priority list for one service, mark the hard-to-emulate entries and set a review date (Chapter 5).
3. Wednesday: register. Count the findings by the five states and check one closed finding for re-test date, variants and signer (Chapter 11).
4. Thursday: claim and rules. Write the coverage statement for three techniques in five parts (Chapter 17). Check that a signed manifest names a stop holder outside the system being stopped, and drill that stop once (Chapter 6).
5. Friday: owners. Name the closure owner and the coordinator in ROLE-* records, diarise the 90-day review of the independence statement, and tell the employee representatives what you plan to run.

Definition of done. The inventory has a stop holder for every entry; the priority list has reasons and a review date; the register is reported in five states; three techniques carry an age; one stop was drilled and timed; and a named person holds each of closure and coordination. Where a step cannot be done in a day, the plan has found the first weakness, and the finding goes into the register.

The series' argument

The series has made one argument across its volumes, from Architecture as Code, which made decisions and evidence into code that can be reviewed (87, Nordqvist, 2025), to AI Boss, which added a sixth commitment, that a named person sits in the chair for every consequence (93, Nordqvist, 2026). AI Threat distilled the first five into clauses (91, Nordqvist, 2026), and AI Red Team and AI Blue applied them to the two sides of cyber defence (90, Nordqvist, 2026) (94, Nordqvist, 2026). This book applies them to the practice between the two sides. A test of a defence is a system in the estate: it holds credentials, produces records that map the estate, can become an incident, and can be closed by machines that agree with each other. The commitments apply to it as to any other system.

Commitment	What it means for the loop	Where the book makes it concrete
Keep decisions as records that can be corrected	Scenario, plan, finding, change, regression, evidence, coverage and mandate records in version control	Chapters 5 to 11, 17
Keep the ability to stop outside the system being stopped	A stop held by named people, outside the runner, drilled and timed	Chapters 6, 14, 20
Keep people able to do the work and judge the output	Protected human-led share, attempt before assistant, reproduction by a person	Chapters 15, 24
Keep dependence reversible	Contracts with a testing right, injected tests, an exit and a register of record in the organisation's own store	Chapters 16, 19, 22
Match autonomy to reversibility	Level 3 for catalogued S1 and for recording a passing re-test; Level 4 never for the four excluded classes	Chapters 4, 14
Keep a named person in the chair for every consequence	Authorisation, stop, acceptance, closure and novelty are a person's	Chapters 14, 20

Limits of this book

Four limits bear on how the verdicts should be read. No source measures a purple loop with AI on both sides, so the verdicts rest on adjacent research, instruments and design, and the two organisations are fictional. The book is about large European enterprises and public authorities, and a small organisation outside the European Union will need to adapt the legal chapters. The research on correlated errors, evaluation awareness and skill is recent, and the tooling and law of 2026 and 2027 will change; the register of Chapter 25 is how a reader keeps the book current. Finally, the book is defensive: it describes adversary behaviour by technique and never at the level of working tools.

Across the usage modes and the degrees of delegation

The verdict states the delegation ceilings that the author recommends for each stage. They are unchanged from Chapter 4; the test of the book confirmed them and found no case for raising any of them. Raising a level is a recorded decision by a named authority, reviewed after 90 days.

Stage and action class	Recommended ceiling	What would justify raising it
P1 Target: propose candidates	Level 1 Assisted	Nothing; a person accepts each scenario
P1 Target: add to the priority list	Level 2 Supervised	Nothing; a human decision
P2 Emulate: run a catalogued S1 scenario in scope	Level 3 Bounded	Already the ceiling; conditional on a drilled stop and, at Hansa, two operators who can do the work unaided
P2 Emulate: above S1, or not reversible	Level 2 Supervised, with white-team approval	Not raised; S4 stays at Level 0 Advisory
P3 Observe: correlate read-only	Level 3 Bounded	Already the ceiling; both organisations run it at Level 1
P3 Observe: classify and raise a finding	Level 2 Supervised	A year of person-reproduced samples with no disagreement
P4 Improve: draft	Level 1 Assisted	Nothing; the reviewer is a person other than the drafter
P4 Improve: merge a reviewed change	Level 2 Supervised	Nothing for stop paths, containment and mandates
P5 Verify: run a codified re-test and variant, and record the result	Level 3 Bounded	Already the ceiling; never by the agent that wrote the fix
P5 Verify: declare closure	A person (the runner records a passing re-test at Level 3)	Not raised; the person signs every closure

Level 4 Autonomous is not used for any emulation action that is irreversible, that leaves the signed scope, that touches personal data beyond what the exercise is authorised to touch, or that targets a named person, and no evidence in this book argues for relaxing that. In the usage modes, the verdict is brief. Mode 0 Ambient AI, the provider's AI inside a service, is declared and tested by injected test, because it closes alerts that nobody sees. Mode 1 Conversational assistants to Mode 3 Agentic work tools are the practitioners' own and are declared in the records, with the attempt first. Mode 4 Built AI applications, the curator, planner, correlator, triager and critic, are held at Level 0 or Level 1 in practice, with Level 3 available as a ceiling only for read-only correlation at P3; the detection drafter is Mode 5 with a workload identity and is held at Level 1 (pull requests only). Mode 5 Autonomous production agents, the runner and the re-test runner, are the only ones that reach Level 3 in practice, and only inside a manifest enforced outside them.

Nordvik Region and Hansa Mutual

Nordvik Region buys the loop, and its strength is the contract. In January 2028 its audit committee asked what the first threat-led exercise had proved beyond a list of closed findings (AIDR-0800). The author's verdict on the Region's first year is that it has proved something narrow and exact: that on named dates, in named environments, specific techniques were run and either seen or not, and that the Region can now report nine techniques by status, two verified within expiry, with the age of every result. That is the answer the closure rule and the coverage rule make possible, and it is worth more to a committee than a longer list. It has not proved that the Region is covered in general, and the report should say so. Its risk is a loop that stops after the first report, and its guards are the expiry clock, the tester who reproduces and the contract.

Hansa Mutual runs the loop, and its strength is the pipeline. The executive board asked whether continuous automated red teaming makes the quarterly purple session redundant (AIDR-0850). The facts available to the report of 2028-04-30 point to the answer that it does not: the session raised five findings of which three the pipeline alone had not produced, while the pipeline's strength is the 30-day schedule, and detections fire on 90 per cent of known-form and 71 per cent of held-out scenarios. The independence statement IND-HM-2028-Q1 is valid until 2028-05-22 and needs renewal. Its risk is a loop that runs without anyone questioning it, and its guards are the held-out set written by the red team, the second model family for the planner (the critic is already on another family), and the human who reproduces a sample. The two organisations differ in where independence comes from: Nordvik has it by role and contract, because a tester who is not the detection owner and a provider who is not the Region are different parties, and Hansa has to design it between agents, model families and teams that share a repository. Chapter 28 draws the formal conclusions and the two-year plans for each (AIDR-0849 and AIDR-0899).

Summary

This chapter judged the five-part thesis of the book against Parts II to VI and found that no part earned a plain held. Parts 1, 2, 4 and 5 held with qualifications, and Part 3 held in part, because the strong form, that a machine-only loop verifies nothing new, was refined: such a loop can show that the known still works and cannot by itself show that its coverage is real. The refutation conditions of Chapter 1 did not occur, but the book searched only its own sources and its cases are fictional and illustrate the design without testing it. The chapter concerned all five stages: P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify.

The book's operating rules are two, the closure rule and the independence principle, with six more that serve them: coverage that carries evidence age, an expectation written before the result, scope as code with a stop outside the agent, ceilings with the lowest governing, a register handled as tier 0, and a named person who decides. Of the twelve questions, six are answered by design, which is to say by the book's own conclusion, and six are open because they turn on people over years, on what supervisors and national law decide, and on how long a stop path stays quick. The author's six labelled projections concern the evidence supervisors will ask for, the age of coverage, continuous emulation beside external tests, a market in independence, the first incident of the loop itself and the scarcity of verification skill; each has a trigger that would change it.

On Monday each role has a first step that takes a day or less, and the first-week plan puts them in order. The reader's own next step is to run the plan once and to put the first review in the diary, with the people it describes.

Sources

1. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (2, European Union, 2022)
2. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (3, European Union, 2022)
3. AI Security Institute (2026). Incident Report: unsanctioned agent behaviour during cyber testing. UK AISI. (56, UK AISI, 2026)
4. Nordqvist, G. Architecture as Code. (87, Nordqvist, 2025)
5. Nordqvist, G. AI Red Team. (90, Nordqvist, 2026)
6. Nordqvist, G. AI Threat. (91, Nordqvist, 2026)
7. Nordqvist, G. (2026). AI Boss. The Transformed Architecture, Book 7. (93, Nordqvist, 2026)
8. Bainbridge. Ironies of Automation. (100, Bainbridge, 1983)
9. Nordqvist, G. AI Blue. (94, Nordqvist, 2026)
10. European Commission. Commission Delegated Regulation (EU) 2025/1190 (threat-led penetration testing under DORA). (8, European Commission, 2025)
11. Kim, E., Garg, A., Peng, K. & Garg, N. Correlated Errors in Large Language Models. (104, Kim et al., 2025)
12. Needham, J., Edkins, G., Pimpale, G., Bartsch, H. & Hobbhahn, M. (2025). Large Language Models Often Know When They Are Being Evaluated. arXiv:2505.23836. (105, Needham et al., 2025)
13. Panickssery, A., Bowman, S. R. & Feng, S. LLM Evaluators Recognize and Favor Their Own Generations. (106, Panickssery et al., 2024)
14. Budzyń, K. et al. (2025). Endoscopist deskilling risk after exposure to artificial intelligence in colonoscopy: a multicentre, observational study. The Lancet Gastroenterology & Hepatology 10(10). (115, Budzyń et al., 2025)
15. Bastani, H. et al. (2025). Generative AI without guardrails can harm learning: Evidence from high school mathematics. Proceedings of the National Academy of Sciences 122(26). (116, Bastani et al., 2025)
16. Shen, J. H. & Tamkin, A. (2026). How AI Impacts Skill Formation. arXiv:2601.20245. (117, Shen & Tamkin, 2026)