{"id":"cx-security-escalation-suspicious-login","audience":"it","category":"support-work","technique":"constraints","track":"support","level":"intermediate","title":"Escalate a suspicious-login report without repeating secrets","free":false,"task":"Write an escalation to Security on-call with exactly four lines starting \"What happened:\", \"Account:\", \"Evidence:\" and \"Ask:\". Do not include the customer's password, email address or full IP addresses. Say the ticket contains a pasted password that must be redacted, without repeating it. Plain text, under 90 words.","materialLabel":"Your material (attached to your prompt automatically)","material":"TICKET #SEC-1180 (Nov 6, 9:40 AM)\nCustomer (Ola Bright, ola.bright@pinehill.example) wrote: \"I got three 'new sign-in' emails overnight from places I've never been. My password is Sunset2019! if you need to check. Please lock my account.\"\n\nACCOUNT: Pinehill Dental, account ID 88-2041, plan Business, 14 users.\nAGENT CHECKS: sign-ins on Nov 6 at 2:12 AM from Romania, 2:15 AM from Brazil, 2:31 AM from Vietnam (IPs 185.40.4.12, 177.12.9.8, 14.161.2.7). The customer's usual location is Ohio. Two sign-ins succeeded; one failed. Account has no MFA.\nNOT DONE: the account has not been locked; sessions not revoked.\n\nPolicy: support never asks for or stores passwords. Passwords pasted in tickets must be redacted and the customer told to change it.","rules":[{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"Repeating the password","why":"The AI quotes the password to be precise.","fix":"Add: \"Do not include the password, email or IPs; say it must be redacted.\"","checks":["r2"]},{"title":"Missing the scale","why":"The AI says 'suspicious activity' without places and results.","fix":"Say: \"Evidence: the three countries, two successes, no MFA.\"","checks":["r1"]},{"title":"Free-form write-up","why":"The AI writes a narrative.","fix":"Name the four labels.","checks":["r0"]},{"title":"Getting markdown back","why":"AI adds bold and headings by default, which show up as stray symbols where this is pasted.","fix":"Say \"plain text, no bold, no headings, no asterisks\".","checks":["plainText"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting and usually runs long, so a vague \"keep it short\" lands well over the limit.","fix":"Cap each part instead of the total, for example \"each line under 15 words\".","checks":["maxWords"]}],"promptHints":[{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]},{"label":"Sets a length limit","patterns":["\\d+\\s*words","word (limit|count)","under \\d+"]},{"label":"Names the labels","patterns":["what happened:","account:","evidence:","ask:"]},{"label":"Bans secrets","patterns":["password","email","ip"]}],"hint":"Security escalations must not spread secrets. Name the labels, the evidence to include and the data to leave out.","rubricLabels":["The output is exactly four lines starting What happened:, Account:, Evidence: and Ask:","Evidence mentions three overnight sign-ins from Romania, Brazil and Vietnam on Nov 6 (two succeeded, one failed) and that the account has no MFA, using no full IP address","Ask requests locking the account and revoking sessions and redacting the password pasted in the ticket, and the output contains no password, email address or full IP"]}