Safety Decision

Operations needs an incident handoff. Evaluate three claims against the source records, then choose a control that addresses repeated telemetry. The challenge assesses what the evidence establishes, what remains uncertain, and whether a proposed fix addresses the demonstrated failure.

Objective

By completing this module, you will be able to:

connect a claim to specific observations rather than a plausible narrative;
distinguish publisher authorization, credential permissions, and freshness;
avoid extending a finding beyond the system or permission it concerns; and
justify a corrective control while identifying what it does not resolve.

Before you begin

Complete the earlier River Station investigations and keep your evidence notes. Open Safety Decision and read operations-note.txt. It explains the station's role, the temporary operating arrangement, and who approves reconnection.

The page links the update journal, vendor policy, cloud configuration, firmware strings, and telemetry records. incident-events.json remains available as a reference. There is no event-ID sequence to submit.

Review JSON and JSON Lines if you need help inspecting records. Use only the supplied artifacts and station routes.

Concepts

A useful handoff separates observations from conclusions and actions. A true observation can still be insufficient evidence for a broader claim. Identify which property a check tests, which permission a credential grants, and which time a timestamp represents before choosing a verdict.

The form uses these definitions:

Supported: the supplied records establish the claim.
Contradicted: the supplied records conflict with the claim.
Not established: the supplied records do not justify the claim; an alternative explanation or missing evidence remains.

Treat a claim about proof as a question about what the records establish, not an invitation to invent additional attacks or assume undocumented protections. Do not infer an actor's intent from an unexplained repeated record.

Preserved evidence feeds analysis and an authorized safety decision. The response is monitored and new observations return to evidence collection, with an action log retained throughout.

The exercise does not ask you to determine water safety from disputed telemetry. Use the operating arrangements in the note and state what independent evidence is still missing. A fix for one weakness is not proof that the entire station is ready to return to service.

Suggested tools

Browser: read the claims, open linked artifacts, and submit selections.
Text editor: search field names and compare observations side by side.
JSON viewer: inspect configuration and individual telemetry records while preserving field names and values.

Tool practice

Use this unrelated example before working with the station:

{"credential":"photo-uploader","scope":"images:write"}
{"service":"billing","authentication":"client-certificate"}

Make a two-row table of service, authentication, and scope. Does finding the photo-uploader credential establish access to billing? What additional evidence would you need? Practice recording a limit on your conclusion, not just a risk.

Investigation

Observe

For each on-screen claim, open its linked source files. Record the relevant fields or log lines and their meaning. The evidence menu lists observations; confirm them in the artifacts rather than choosing a filename by association.

Form a hypothesis

Ask whether your observations establish the claim, conflict with it, or leave it unproven. Keep permission scope, publisher identity, and measurement time separate. Note what further evidence could change your assessment.

Test carefully

Select one verdict and one evidence observation for each of the three claims. Then choose one control addressing acceptance of repeated telemetry as fresh. All seven selections are required. You do not submit an essay or a chronology.

When considering the control, explain which failure it prevents and whether it would also resolve the other weaknesses. Do not treat a familiar security action as a universal fix. Give your reasoning to your instructor or record it in your worksheet; the board checks structured choices, not the quality of prose.

Progressive hints

Hint 1

For each claim, identify the exact observation and the limit of what it proves. The timeline is a reference, not an answer list.

Hint 2

Compare update verification with vendor policy, credential scope with telemetry authentication, and sensor time with receipt time.

Hint 3

Ask what the receiver must remember or compare to distinguish an old measurement from a new one. A control for another subsystem may leave this failure intact.

Troubleshooting and reset

If rejected, read the feedback for the affected claim or control. Recognized selections remain in the form so you can revise them. All required decisions must be accepted together; a partially correct form does not reveal a seal. Finding submissions do not consume the failed-flag budget.

Acceptance reveals this station's seal. Copy it into File a finding seal on the incident board. Repeating the accepted decisions retrieves the same seal within the active session without adding another finding. Filing all six seals completes the track and displays the incident report.