GAME BRIEFING
How this lens changes the investigation
Access defines a candidate set, not a culprit. Shared credentials, delegated work, stolen badges, remote sessions, maintenance privileges, and inherited permissions all widen the gap between authorization and action.
Observable clues
- Who possessed direct, delegated, temporary, inherited, or emergency access.
- Whether the audit event identifies a credential, device, session, person, or merely a role.
- Evidence of credential sharing, compromise, automation, or proxy action.
- Physical, behavioral, or independent digital evidence connecting a person to the act.
Evidence tests
- List everyone and every system with plausible access at the time.
- Identify what the log actually authenticates.
- Seek a second modality connecting actor to action.
- Do not infer motive until action attribution is independently supported.
Do not assume
- Treating possession of permission as evidence of use.
- Assuming a credential uniquely represents a human.
- Ignoring service accounts, automation, or delegated tasks.
- Turning role-based suspicion into guilt.
Gameplay outcomes
- Prevents wrongful accusation of the most visibly authorized person.
- Makes credential integrity and identity custody playable evidence problems.
- Supports due-process branches and appeal.
FICTIONAL PRACTICE // NO ANSWER STORED
Work the lens before revealing the reasoning
Shadow Chorus shows Dr. Sayer’s credential opening a sealed profile while she is recorded in a supervised conference.
Credential EMP-014 opened the profile.
Sayer appears continuously on conference video.
Clinical assistants can launch delegated sessions under an attending credential.
Security says Sayer had reason to conceal the profile.
Determine what is proved before considering motive.
Reveal the worked result and explanation
Defensible result
Use of Sayer’s credential is proved; Sayer’s personal action is not. Delegation, compromise, and automation remain live hypotheses.
Why
- The log authenticates a credential event, not a body.
- Physical evidence weakens personal action attribution.
- Motive cannot repair a missing attribution link.
Common reasoning failure
Combining access and alleged motive into a conclusion that action must have occurred.
Accessibility: The exercise is a static text comparison followed by an optional disclosure containing the worked reasoning. No answer is submitted, scored, timed, or stored.
Privacy: The exercise runs entirely as rendered HTML. PsychologicalWar.org does not receive or retain a visitor answer.
The elevated source set adds an operational explanation without replacing the public evidence chain.
Open access terminal