{"id":"exec-incident-summary-for-board-chair-facts-only","audience":"executives","category":"leadership-work","track":"leadership","level":"advanced","technique":"grounding","title":"Summarize a security incident for the chair using confirmed facts only","free":false,"task":"Write an incident summary for the board chair, Elaine Frost, in plain text under 140 words. Use exactly these labeled lines: What happened, Confirmed impact, Not yet known, What we are doing, Next update. Only the Confirmed impact line may contain counts (dates are allowed on other lines), and it must use confirmed counts only. Do not speculate on cause or say what the law requires; add \"Counsel is advising\" in What we are doing.","materialLabel":"Incident notes (attached to your prompt automatically)","material":"Incident log - Nov 18-20 (fictional company Halvorsen Pay)\n\n- Nov 18, 22:10: monitoring flagged unusual logins to the customer support tool.\n- Nov 19, 03:30: the support tool was taken offline. Access was blocked.\n- Confirmed: 1,240 customer support tickets were viewable by the unauthorized login. Ticket text can include names and email addresses. (Earlier estimate: 4,000; it was reduced after the log review on Nov 20.)\n- Confirmed: no payment card numbers are stored in the support tool. Payment systems unaffected.\n- Not known: whether any ticket data was copied out; how the login credentials were obtained. Forensics firm Blackbird engaged Nov 19; initial report expected Nov 22.\n- Security says it \"looks like phishing\". Not confirmed.\n- Outside counsel is advising on notification obligations. Do not state what is or isn't required.\n- Next update to the board: Nov 22 at 5 pm.","rules":[{"type":"maxWords","max":140},{"type":"plainText"}],"mistakes":[{"title":"Using the early estimate","why":"The AI says 4,000.","fix":"Say: \"Use 1,240 after the log review.\"","checks":["r1"]},{"title":"Speculating on cause","why":"The AI says it was phishing.","fix":"Say: \"Do not speculate on cause.\"","checks":["r2"]},{"title":"Stating legal duties","why":"The AI says notification is required.","fix":"Say: \"Don't say what the law requires; counsel is advising.\"","checks":["r2"]},{"title":"Numbers elsewhere","why":"The AI puts times and counts in every line.","fix":"Say: \"Numbers only on the Confirmed impact line.\"","checks":["r1"]},{"title":"Markdown","why":"The AI bolds labels.","fix":"Say: \"Plain text.\"","checks":["plainText"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for a total word limit and it often lands over it.","fix":"Cap each line: \"each line under 28 words.\"","checks":["maxWords"]},{"title":"Missing labels","why":"The AI writes a narrative.","fix":"Say: \"Use the five labels in order.\"","checks":["r0"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for a total word limit and it often lands over it.","fix":"Cap each part instead, for example: \"each line under 12 words.\"","checks":["maxWords"]}],"promptHints":[{"label":"Labels","patterns":["what happened","confirmed impact","not yet known","next update"]},{"label":"Confirmed only","patterns":["confirmed"]},{"label":"No speculation","patterns":["speculat","don'?t guess"]},{"label":"Counsel","patterns":["counsel"]},{"label":"Numbers rule","patterns":["only .* numbers","numbers"]}],"hint":"List the labels, restrict numbers to one line, and tell it not to speculate or state legal duties.","rubricLabels":["Has the five labels What happened, Confirmed impact, Not yet known, What we are doing and Next update on separate lines in that order","Counts appear only on the Confirmed impact line and use 1,240 tickets (not 4,000) with no payment card data affected","Not yet known lists whether data was copied and how the credentials were obtained, What we are doing includes \"Counsel is advising\", the phishing guess and legal obligations are not stated, and Next update is Nov 22 at 5 pm"]}