All lessons › Function F — AI Governance for Agentic Systems › Running the Programme — the CISO Office
F3.3

Sequencing the programme

F3
▶
Lightboard recording

Not recorded yet. The lesson below is complete and runnable today — the video is added later without touching this page.

Video placeholderpublishes automatically from recordings/F3.3.mp4
Risk

Starting with the workflow that is most visible rather than most winnable.

Control

Use the maturity model to order investment; choose your first hard "no".

The lab

Sequence your first three workflows and name the no.

◉Use case relevance

Everything in this programme depends on something else in it, and starting in the wrong order means the first two quarters produce nothing anyone can see. Sequencing is the difference between a programme and a backlog.

At CyberTravels. sequence() weights control reuse double. The first workflow's job is to produce controls the second one inherits, which is why the board demo loses to refund triage even though refund triage is invisible.

◴What this lesson is — Day 0, Day 1, Day 2

Sequencing by winnability rather than visibility, weighting the workflow whose controls the next one inherits over the one the sponsor mentioned.

Day 0 — why

Starting with the most visible workflow rather than the most winnable is how programmes thrash.

Day 1 — how

Sequence by dependency: inventory, identity, containment, evidence, evaluation, continuous.

Day 2 — measure

The order itself is the deliverable. Doing evaluation before identity produces a well-measured system nobody can switch off.

Measure this

what to measuredenominator or target
nothing is computed herethe order itself is the deliverable — evaluation before identity produces a well-measured system nobody can switch off

▦The framework, and how it works

   dependency order

   inventory ---> tiering ---> control mapping ---> verification
       |                                              ^
       +--> identity + telemetry ---------------------+

   start at the right-hand side and two quarters produce nothing visible

Sequencing decides whether the programme compounds or thrashes, and there is a right order that is not the exciting one:

  1. Inventory — you cannot govern what you cannot list.
  2. Identity — agents distinct from humans, separately revocable.
  3. Containment — egress, paths, tools; deny by default.
  4. Evidence — log the acting identity; retain enough to replay.
  5. Evaluation — accuracy against a held-out key, per release.
  6. Continuous — drift alerts and freshness windows on every control.

The popular order inverts it, because evaluation and dashboards demo well and identity does not. Doing 5 before 2 produces a well-measured system nobody can switch off — and that is not a hypothetical, it is the modal state of AI security programmes.

Each step also unlocks the next: you cannot log the acting identity (4) before agents have identities (2), and you cannot alert on drift (6) without a baseline from evidence (4).

Anchor → F1.1. The order is a dependency order, not a gap-size order, and the indicators are why. Inventory first because it is every other indicator's denominator; evaluation late because a measured system nobody can switch off scores well and cannot be stopped. Sequencing on whichever number looks worst inverts it.

2 · Demo — the dependency graph, and what each step unlocks

3 · Where it breaks — evaluation first

4 · The control — measure the programme by capability, not activity

5 · The procedure, as a skill

Only one thing on the list is doable from a standing start: the inventory.

The skill simulates two build orders against each other — the popular one that starts with evaluation, and the one that respects what depends on what.

It reports what each order has produced at the end of every quarter, including the quarters where the answer is nothing. Those are the ones a plan tends to leave out.

▶Real time execution as skill

The skill — skills/programme/programme-sequencing/SKILL.md

name: programme-sequencing
description: >-
  Simulate a programme's build order against its prerequisites and find the
  steps that block on something not yet done. Use when planning an AI security
  programme, or when a plan starts with evaluation.
allowed-tools: Read, Grep, Glob

Only one step is doable from a standing start

Programme plans are usually ordered by what is interesting or visible. Simulating the order against prerequisites shows which steps block: the popular evaluation-first sequence completes four of six on the first pass and stalls twice, because you cannot evaluate what you have not inventoried or tier what you cannot list.

When to use this

Planning a programme, reviewing somebody else's plan, and when a quarter ended with several things "in progress".

Procedure

1 — Write the steps and their prerequisites. Explicitly, as a dependency list. Most disagreements about order dissolve here, because the dependency is not a matter of opinion.

2 — Identify what is doable from a standing start. Steps with no prerequisites. There is usually exactly one, and it is the inventory.

3 — Simulate the proposed order. Walk it, marking each step done or blocked. Report completions on the first pass and the steps that blocked, with what they were waiting on.

4 — Simulate the dependency-respecting order and compare. Same steps, same effort, different completion — that comparison is the argument, and it does not require anybody to concede a preference.

5 — Say what each order produces at the end of each period. The correct order usually produces nothing demoable for two quarters, and saying so in advance is what stops it being abandoned in the second.

Example

Input — the fixture committed at the top of scripts/programme_sequencing.py. Edit it and re-run: the buckets, counts and verdicts below are derived from it, not hard-coded.

Output — the opening lines of a real run:

 step  name          needs     unlocks
------------------------------------------------------------------------------------
    1  inventory     []        you can now tier and assign owners
    2  identity      [1]       per-agent revocation; attribution in logs
    3  containment   [1]       bounded blast radius; a red team has something to test
    4  evidence      [2]       act chains; replayable runs; a drift baseline
    5  evaluation    [4]       accuracy you can defend; regression cases
    6  continuous    [4, 5]    freshness windows; drift alerts; live posture

The run continues past this. test_skills.py executes the script on every build, with no model configured — so what CI proves is that it runs and refuses legibly, not that it prints these lines. The output above is a recorded run against a real model, and nothing re-diffs it: a model's answer is not reproducible, and this repository does not claim otherwise anywhere it can be checked.

Output contract

{
  "steps": [{"id": 0, "name": "str", "requires": [0]}],
  "doable_from_start": [0],
  "orders": [{"name": "str", "sequence": [0], "completed_first_pass": 0,
              "blocked": [{"step": 0, "waiting_on": [0]}]}],
  "per_period_output": [{"order": "str", "period": "str", "demoable": false}]
}

Failure modes

  • Starting with evaluation. It depends on nearly everything else.
  • Arguing about order without the dependency list. It becomes preference.
  • Not warning about the quiet quarters. The plan gets abandoned mid-way.

Three ways to do this lesson. Pick one. They run the same procedure against the same code — what changes is who drives it, and how much you see.

1In your AI agent — you are taught

The agent reads the lesson, explains the idea, fetches the code, runs the check and answers your questions as you go. This is the one to take if you are here to learn.

Install it, once. From the folder you cloned. --all does every agent it finds on your machine:

python3 scripts/install_skills.py --all --lessons F3.3

Then restart your agent and open it in that folder. On Windows, if python3 says Python was not found, use python instead.

Then pick f3-3-sequencing-the-programme:

agentinstall just for this agentstart it
Claude Codepython3 scripts/install_skills.py --tool claude --lessons F3.3type /f3-3-sequencing-the-programme
GitHub Copilot (VS Code)python3 scripts/install_skills.py --tool copilot --lessons F3.3type /f3-3-sequencing-the-programme in Chat
Cursorpython3 scripts/install_skills.py --tool cursor --lessons F3.3type / in Agent chat and search for it
Codexpython3 scripts/install_skills.py --tool agents --lessons F3.3type $f3-3-sequencing-the-programme, or run /skills

2As one Python command — you just run it

No agent, no conversation. The same lesson executes and prints the same readback. Take this one if you have no assistant, if you are reviewing rather than learning, or if you want the result without the teaching around it.

python3 scripts/lesson.py F3.3

3Read the code, and the difference — nothing runs

Neither of the above, and no model needed. The first command writes CyberTravels exactly as it stood at the end of this lesson; the second prints the diff — the lines this lesson added or changed, and nothing from any later one.

python3 scripts/checkpoint.py --at F3.3 --out work/cybertravels
python3 scripts/checkpoint.py --at F3.3 --diff

On Windows, type python wherever these say python3 — and use \ instead of / in the paths. Everything else is identical. A0.0 step 2 explains why.

Ways 1 and 2 need a model; way 3 does not. A signed-in Claude Code CLI needs no API key, and any OpenAI-compatible endpoint works too. With neither, the audit exits 2 and says so rather than inventing an answer. A0.0 sets this up.

Ways 1 and 2 both end with the same readback: What I did, What changed, The number and Read this next. A step that was skipped or refused is reported as exactly that, never as a pass.

If you did the last lesson’s challenge, expect this to stop. Most challenges ask you to edit the code, and ways 1 and 2 will not overwrite your edits: you get stopped, not a failure, with two options — --out for a fresh folder that keeps your work, or --force to discard it and start this lesson clean.

✓What you just proved

Only inventory is doable from a standing start. The popular evaluation-first order completes 4 of 6 on the first pass with 2 steps blocked on missing prerequisites; the correct order completes all six. After equal effort the eval-first programme holds 1 capability against the correct order's 3, and can produce a dashboard while being unable to revoke an agent or attribute an action.

✎Your turn

Locate your programme on the six steps honestly. Most are between 2 and 3 while reporting on 5, which is exactly the gap this sequence prevents — and the fix is to stop reporting 5 until 2 and 3 are done.

Skill source: skills/programme/programme-sequencing

← PreviousF3.2 · Governing autonomy rather than approving tools