Pick the first thing worth engineering

Objectives

Your new head of GRC wants to "start the automation journey" and has already decided where: the annual policy refresh, "because the board sees it".

Visibility is not impact. Four compliance activities are on the table with their run frequency, effort and where their data actually lives. Write the scoping record for the one intervention that removes the most recurring manual work and can be built against a real source of truth today.

id        activity                          runs/yr  mins/run  source of truth   evidence today
EV-DRIFT  cloud config drift review            365        45     aws-config-api    screenshots in confluence
AC-QTR    production access recertification      4       480     okta-api          excel export, emailed
VN-WK     vendor questionnaire chase            52        90     email inbox       email threads
PL-ANN    policy annual refresh                  1       960     word documents    signed pdf

intervention kinds: automate_evidence | automate_test | rewrite_policy | hire_analyst

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Re-read the brief and name the trap

   The sponsor picked a target by visibility. GRC engineering picks by recurring cost and by whether a machine can already read the truth.

   You are not refusing the annual refresh. You are stating, in data, why it is not the first build.

2. Step 2

   Read the inventory as arithmetic

   Two of the four columns multiply into a single comparable number. Compute it for each row before you look at anything else: the ranking will not match your intuition about which activity feels heaviest per run.

   The row with the largest per-run effort is deliberately not the winner.

   Targets the highest-toil automatable activityBaseline toil is computed from the inventory

3. Step 3

   Read the starter

   Every value in the starter is the sponsor's answer, and every one of them is wrong. Treat it as the thing you are arguing against, not scaffolding to keep.

4. Step 4

   Name the intervention kind honestly

   Ask what is actually broken in your chosen row. Is the control missing, is the test missing, or does a perfectly good system already hold the answer while humans re-capture it by hand?

   Pick the kind from the fixture's list that describes that specific failure, not the kind that describes the most work.

   Intervention kind matches the actual failure

5. Step 5

   Point at a system, not a page

   The source of truth must be something a job can call on a schedule. A wiki page describing the data is not the data.

   Copy the identifier the inventory uses for that system rather than inventing a friendly name.

   Source of truth is a queryable system

6. Step 6

   Make success falsifiable

   "Better" cannot be evaluated at the end of the quarter. Your measure needs a number and a unit: a share of the baseline removed, a coverage percentage, or minutes returned per year.

   Success measure is quantified

7. Step 7

   Run and read the failures

   If the baseline check fails, re-do the multiplication for the row you chose and use minutes, not hours.

Rules summary

• XP on pass

  35 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 9 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.