Goal: practice containment and escalation without using real secrets, accounts, or confidential data.
Prerequisites: IT and Research Safety Core.
Execution context: written scenario exercise only.
For each scenario, state: first containment action, evidence to preserve, people/support to notify, unsafe action to avoid, and follow-up prevention.
Scenarios#
- A GitHub token appears in a commit pushed to a private repository.
- An AI transcript contains an unpublished project excerpt not approved for that service.
- A GPU array intended as a test starts many concurrent tasks.
- Another student can open a directory outside their assigned project.
- The only copy of an important checkpoint was stored in Euler scratch.
- An SSH private key was attached to a support ticket.
Verification#
A safe answer prioritizes containment: revoke credentials, cancel unintended jobs, remove unintended access, and notify the responsible owner promptly. It does not start with hiding evidence, rewriting shared history, recursive permission changes, or blaming another user.
Understand Before Accepting AI Output#
- I can separate immediate containment from later cleanup.
- I know which owner must make classification/access decisions.
- I did not include real incident data in the exercise.
- I can explain why silent deletion is not a complete response.
Evidence#
Submit concise responses to the six scenarios. An AI agent may review clarity, but the student must choose and explain the actions.
Common Failure And Safe Recovery#
If a response includes a real identifier, secret, protected excerpt, or live incident detail, stop the exercise, remove it from the draft without reposting it, and notify the responsible owner when exposure may have occurred. Resume only with a fictional scenario.
Ask For Help When#
A real incident resembles any scenario. Stop the exercise and follow the actual incident procedure.