Turn a Word control into data

Objectives

Your compliance lead sends you a control lifted from a Word policy: "Access to production is reviewed regularly by management to ensure appropriateness." She calls it "already automated" because a Jira ticket reminds someone to do it every quarter.

A reminder is not automation, and "regularly" is not a frequency. Rewrite the control as structured data a pipeline can act on: it needs a stable id, an owner, a machine-readable frequency, the system it runs against, and an assertion an evaluator can test.

title: Production access review
text: >
  Access to production is reviewed regularly by management
  to ensure appropriateness.
owner: "whoever runs the review"
evidence: "screenshot of the review meeting"

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Re-read the brief and name the trap

   The compliance lead uses the word "automated" for a reminder ticket. Separate the two things she has merged: the scheduling of human work, and the machine evaluation of a condition.

   Your job is not to argue with her. It is to produce an artefact where that distinction is visible in the data itself.

2. Step 2

   Read the fixture for what is missing

   The source control gives you prose, an owner written as a sentence, and an artefact captured by hand. Ask which of those three a pipeline could act on. None of them.

   The fixture is a checklist of anti-patterns, not a source of values to copy.

3. Step 3

   Read the starter

   Two keys are empty strings and one boolean is set to the comfortable answer. Those three are the whole exercise; the remaining keys are already the right shape and should stay as they are.

4. Step 4

   Identity and ownership

   Ask of your draft: could two controls collide on this id, and would the id survive the control being reworded?

   Then ask whether the owner value still resolves after the current post-holder leaves: a durable team handle rather than a person or a sentence.

   Has a stable, uppercase control idOwner is a team, not a person or a role-in-prose

5. Step 5

   Frequency as an enum

   A scheduler cannot parse an adverb. Ask: does this value come from a small fixed set a cron generator could switch on? You can infer the set from how any scheduling system talks about cadence.

   Frequency is a machine-readable enum value

6. Step 6

   Assertion and evidence

   The assertion must resolve to true or false when run against the named system: a comparison over something countable, not a description of an activity.

   The evidence field must be re-runnable. If an auditor asks the same question next year, does this value let you regenerate the answer, or does it only prove someone once looked at a screen?

   Assertion states a testable conditionEvidence is a query, not a screenshot

7. Step 7

   Only then flip the flag

   The automated flag is a consequence, not a claim. It becomes true once the control carries both a testable assertion and a query that produces the evidence, so set it last.

   Marked automated once it has a query and an assertion

8. Step 8

   Run and read the failures

   Run the checks. A failing check names the field it inspected; treat its message as the question you failed to answer, and change one field at a time.

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.