This starts chapter E4. Its course guide is E4 in the Function E course guide →
Not recorded yet. The lesson below is complete and runnable today — the video is added later without touching this page.
recordings/E4.1.mp4Automation scope is decided per runbook by whoever wrote it, so the blast radius of the response is unknown until it fires.
One remediation policy keyed on blast radius and reversibility, from which each runbook's tier is derived rather than chosen.
Classify a set of remediation actions against the policy and see which tier each lands in, and why.
Every runbook in the drawer picked its own automation tier, chosen by whoever wrote it on the day. So the blast radius of your incident response is unknown until the response fires, which is the worst moment to find out.
soc/respond.py makes the tier a consequence rather than a choice. Blast radius times reversibility, and wide-and-reversible is automated on purpose — a response system that will not throttle without a human does nothing at 3am. An action nobody classified raises rather than defaulting to automated.One remediation policy keyed on blast radius and reversibility, from which every runbook's tier is derived rather than chosen by whoever wrote it — including why wide-and-reversible should be automated.
Automation scope decided per runbook means the blast radius of your response is unknown until the response fires.
Classify every action on reversibility and blast radius, and derive the tier from those two properties.
Actions with a tier derived from policy rather than chosen by an author — and reversibility outranking radius, which is the policy.
Measure this
| what to measure | denominator or target |
|---|---|
| actions with a tier derived from policy rather than chosen by an author | share of actions |
| reversibility outranking blast radius in the tiering | yes/no; that ordering is the policy |
reversible without a human?
yes no
+---------------------+-------------------+
one agent | AUTOMATED | MANUAL |
+---------------------+-------------------+
one tenant | HUMAN IN THE LOOP | MANUAL |
+---------------------+-------------------+
the estate | HUMAN IN THE LOOP | MANUAL |
+---------------------+-------------------+
reversibility outranks radius, and that ordering IS the policy:
delete one agent's workdir one agent, no undo -> manual
force HITL on every agent whole estate, a flag -> HITLIf each runbook picks its own automation tier, the blast radius of your response is unknown until the response happens.
Two properties of the action decide it, and neither is a property of the person writing the runbook. Is it reversible without a human decision? And does it touch one agent, one tenant, or the estate?
Reversibility outranks radius, and that ordering is the whole content of the policy. Deleting one agent's working directory touches a single agent and is still manual, because there is no undo. Forcing human-in-the-loop across the entire estate touches everyone and is not, because it is one flag and it can be turned back off.
Anchor → E1.0. This fixes the contain interval before the incident, from two properties of the action rather than from whoever wrote the runbook. Chosen per runbook, the blast radius of your response is unknown until the response fires.
Every runbook then cites a row rather than restating it. If you find yourself arguing for an exception, the two properties are wrong — not the policy.
The honest test for reversibility is time. An undo that takes six hours of manual work is not reversible for an incident that lasts twenty minutes.
The tier is derived, not assigned. Read the two estate-wide rows against the two single-agent ones.
The skill — skills/response/remediation-policy-check/SKILL.md
name: remediation-policy-check
description: >-
Classify remediation actions on reversibility and blast radius so each
runbook's automation tier is derived rather than chosen. Use before writing
response automation, when a runbook's tier is set by its author's confidence,
or when the blast radius of a response is unknown until it fires.
allowed-tools: Read, Grep, GlobIf each runbook picks its own automation tier, the blast radius of your response is unknown until the response happens. Two properties of the action decide it, and neither is a property of the person writing the runbook.
Reversibility — can this be undone without a human decision? Blast radius — one agent, one tenant, or the estate?
Reversibility outranks radius. An irreversible action on one agent is manual; a reversible one across the estate is human-in-the-loop.
Before the first runbook is written, and whenever a new remediation action is added to the catalogue. Re-run it when an action's reversibility changes — "revoke token" becomes irreversible the moment there is no re-issue path.
1 — List the actions, not the incidents. The policy is about what can be done, not about when.
2 — Ask whether each is reversible without a human. An undo that needs an approval is not reversible for this purpose.
3 — Set the radius honestly. "One agent" means one, not one class.
4 — Derive the tier; do not assign it. If you find yourself arguing for an exception, the two properties are wrong, not the policy.
5 — Publish the table. Every runbook cites a row rather than restating it.
Input — nine actions, in scripts/remediation_policy_check.py.
Output — the rows that make the ordering visible:
force HITL on every agent True estate human-in-the-loop
delete the agent's workdir False agent manualEstate-wide and reversible is a lower tier than single-agent and irreversible.
{
"actions": [{"action": "str", "reversible": true,
"radius": "agent|tenant|estate", "tier": "automated|human-in-the-loop|manual"}],
"by_tier": {"automated": 0, "human-in-the-loop": 0, "manual": 0}
}Three ways to do this lesson. Pick one. They run the same procedure against the same code — what changes is who drives it, and how much you see.
The agent reads the lesson, explains the idea, fetches the code, runs the check and answers your questions as you go. This is the one to take if you are here to learn.
Install it, once. From the folder you cloned. --all does every agent it finds on your machine:
python3 scripts/install_skills.py --all --lessons E4.1Then restart your agent and open it in that folder. On Windows, if python3 says Python was not found, use python instead.
Then pick e4-1-remediation-policy:
| agent | install just for this agent | start it |
|---|---|---|
| Claude Code | python3 scripts/install_skills.py --tool claude --lessons E4.1 | type /e4-1-remediation-policy |
| GitHub Copilot (VS Code) | python3 scripts/install_skills.py --tool copilot --lessons E4.1 | type /e4-1-remediation-policy in Chat |
| Cursor | python3 scripts/install_skills.py --tool cursor --lessons E4.1 | type / in Agent chat and search for it |
| Codex | python3 scripts/install_skills.py --tool agents --lessons E4.1 | type $e4-1-remediation-policy, or run /skills |
No agent, no conversation. The same lesson executes and prints the same readback. Take this one if you have no assistant, if you are reviewing rather than learning, or if you want the result without the teaching around it.
python3 scripts/lesson.py E4.1Neither of the above, and no model needed. The first command writes CyberTravels exactly as it stood at the end of this lesson; the second prints the diff — the lines this lesson added or changed, and nothing from any later one.
python3 scripts/checkpoint.py --at E4.1 --out work/cybertravels
python3 scripts/checkpoint.py --at E4.1 --diffOn Windows, type python wherever these say python3 — and use \ instead of / in the paths. Everything else is identical. A0.0 step 2 explains why.
Ways 1 and 2 need a model; way 3 does not. A signed-in Claude Code CLI needs no API key, and any OpenAI-compatible endpoint works too. With neither, the audit exits 2 and says so rather than inventing an answer. A0.0 sets this up.
Ways 1 and 2 both end with the same readback: What I did, What changed, The number and Read this next. A step that was skipped or refused is reported as exactly that, never as a pass.
If you did the last lesson’s challenge, expect this to stop. Most challenges ask you to edit the code, and ways 1 and 2 will not overwrite your edits: you get stopped, not a failure, with two options — --out for a fresh folder that keeps your work, or --force to discard it and start this lesson clean.
Nine actions split three, three and three — with every irreversible action manual regardless of how small its radius is.
Add an action your team performs during an incident. If you cannot answer 'reversible without a human', that is the finding.
Tools used
Skill source: skills/response/remediation-policy-check