Module Summary

What this module established

An assistant collapses translation, not reasoning. The hours in a shift go on turning a question you already understand into a query language you use often enough to be competent and not often enough to be fluent. That is what gets faster. Choosing the question, knowing the estate, making the decision and owning the outcome do not move.

Reliability tracks how much of the answer you already hold. Ask for expression of something you understand and you will catch an error, because you know what the answer should look like. Ask it to determine something you do not understand and you have no way to check, which is when it is most likely to be confidently wrong.

The failure is not a diligence problem. You judge a colleague on latency, hedging, register and track record, and that heuristic works because human confidence and human accuracy correlate. Generated output removes every one of those signals and keeps the confident register.

Plausibility and correspondence are different checks. Reading an artifact attentively and finding nothing malformed feels like verification. It is not. Correspondence means asking what would have to be true for this to answer your question, and confirming it.

Six failure modes cover the practical ground: plausible field, silent window, wrong join key, confident absence, right answer to the wrong question, invented precision. Each carries a check, and running them in cost order means the ones you abandon under pressure are the ones that overstate a figure rather than the ones that close an incident wrongly.

Automated judgment is already in your estate. What is new is automated language: action has been policy-governed for years, and language arrives in an analyst's hands with no policy attached.

The estate is the point. Every fact about Northgate is absent from any model's training data. The assistant supplies fluency with the language; you supply everything about the place, and most wrong answers are a general truth applied to a specific estate where it does not hold.

The one question to carry forward

What would have to be true for this answer to be correct?

Everything in the next nine modules is a variation on it. The six failure modes exist so that the question has a short, finishable answer rather than an unbounded one.

Your first step

Not a summary of the module. What to do on your next shift.

THIS WEEK                                        about 20 minutes total

[ ] Pin the pre-flight from 0.5 somewhere you will see it.

[ ] Rewrite one request before sending it. Replace "around the
    alert" or "recently" with an absolute time range. Notice
    whether the answer changes.

[ ] On the next empty result you get, prove the query could have
    returned rows before you treat the zero as a finding.

[ ] Ask your estate one boring question. Daily sign-in volume,
    or which accounts are noisiest. You are building the baseline
    that makes everything else checkable.

[ ] Once, write down your judgment of a generated artifact BEFORE
    you check it. Then check it. That number is your calibration.

The next thirty days

One action a week. The habit is built by repetition at low intensity, not by a push.

WEEK 1   SCOPE
         Rewrite every request that contains a relative time.
         Count how many you catch. It will be more than you expect.

WEEK 2   DELEGATE
         Take one question you would normally ask whole
         ("is this suspicious?") and decompose it into the
         three or four data questions underneath it.

WEEK 3   PROVE
         Run the five-point pre-flight on every generated query
         for one shift. Time yourself. It should fall under a
         minute by the end of the day.

WEEK 4   OWN
         Write one handover note that says what you CHECKED,
         not that you reviewed. "Confirmed the filter selects
         failures" rather than "reviewed the query".

Individual, team, organization

What changes when this stops being your own practice.

INDIVIDUAL     The four verbs, run silently, on your own work.
               Nobody else needs to know you are doing it.

TEAM           Two changes worth making, both cheap:
               - Handover notes say what was checked, not that
                 checking happened
               - Sample a few closed alerts a week and ask
                 "what would have made you doubt this?"
                 An analyst who cannot answer has told you
                 something no throughput metric will

ORGANIZATION   Three things that need a decision rather than
               a habit:
               - Which tools are sanctioned, and the data terms
                 in writing (0.6)
               - What may be delegated without review, with a
                 named check, and never
               - Whether generated artifacts that contributed
                 to a close are retained, so an incident review
                 can reconstruct the reasoning

What comes next

Module 1 takes the same habit into query and telemetry work properly: four generated queries per exercise rather than four in a module, across the tables you will actually use. From there each module is a discipline. Detection engineering, hunting, investigation, reporting, automation, architecture, governance, each one worked with an assistant in the loop and each one ending with something you built.