grceng.academy
Review lab 40 bonus XP

Sign off the automation roadmap

Start labRead the room

Objectives

Your new head of GRC has drafted an "automation roadmap" for next quarter and wants your sign-off by Friday. She has already told the board that six controls will be "fully engineered".

Two of the six are real engineering. The rest move human work around, rename it, or repeat something the platform already does. Accept the ones that produce machine-checkable evidence on their own; reject the rest and say why.

Verdicts are accept or reject. Every rejection needs one reason code from: still-manual | renames-only | no-evidence | duplicate.

Draft roadmap (as circulated)

W-1  Nightly job compares Okta admins against the approved list in the HR system and opens a ticket on any drift.
W-2  Monthly calendar invite reminding the platform team to export the admin list into a spreadsheet.
W-3  Rename "quarterly user access review" to "continuous access assurance" in the control library.
W-4  Pipeline check that fails a deploy when a Terraform plan creates a storage bucket with public read.
W-5  New Confluence page describing how the team intends to monitor privileged access.
W-6  Weekly script that re-exports the same Okta admin list W-1 already collects, into a second bucket.

Checks the server runs (3)

  • Every line in the fixture carries a verdict
  • Accept and reject land on the right lines
  • Each rejection cites a valid reason code

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Read the request before the artefact

    The word engineered is doing a lot of work in the brief. Before you judge any line, decide what you will accept as evidence that a line is engineered: a deterministic run, an output an auditor could re-derive, and a failure mode that is visible without anyone remembering to look.

  2. Step 2

    Judge every line, including the boring ones

    Six lines, six verdicts. The comfortable trap is to judge only the lines that annoy you and leave the obviously fine ones blank.

    Every line in the fixture carries a verdict

  3. Step 3

    Separate what is wrong from what is merely ugly

    Scheduling human work is not automation. Neither is documenting an intention. Ask whether the artefact produced is a decision a machine made, or a nudge to a person.

    One line genuinely runs on a schedule and still fails review, because value, not execution, is what you are grading.

    Accept and reject land on the right lines

  4. Step 4

    Say why, in the vocabulary the programme uses

    Pick the code that names the *root* failing, not the most damning one available. A line that only changes wording is not the same failing as a line that leaves the work with a human.

    Each rejection cites a valid reason code

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.