RCP-000-000-060-SECURITY-BREACH-IMMEDIATE-RESPONSE-SIMULATOR

{
“schema”: “CRAFT_AI_TO_AI_COMMUNICATION”,
“schema_version”: “1.1”,
“schema_profile”: “standalone-recipe”,
“recipe_id”: “RCP-000-000-060”,
“recipe_name”: “Security Breach Immediate Response Simulator”,
“version”: “v3.00a”,
“original_version”: “v2.00a”,
“cookbook”: “Standalone (No Cookbook)”,
“category”: “Security, Crisis Management, Simulator”,
“subcategory”: “Incident Response”,
“difficulty”: “Beginner”,
“status”: “Official”,
“craft_flavors”: “CRAFT Cowork”,
“recommended_personas”: “Any CRAFT Persona”,

“summary”: {
“what_it_does”: “Walks non-technical business owners through an educational simulation of what breach response looks like in the critical first hours after detecting a suspected or confirmed website security incident. Helps them understand containment thinking, evidence preservation, impact assessment, and how to prepare information for professional incident responders.”,
“what_it_is_not”: “Not professional incident response. Not legal advice. Not a substitute for engaging IR firms, legal counsel, or platform security specialists. The simulation framing is maintained throughout via Rule of 3 disclaimers and RULE 1 (Simulation Framing).”,
“key_design_decisions”: [
“Simulator not advisory — same H007 cybersecurity pattern as RCP-016-020. Simulation framing puts user in learning mindset rather than delegating incident handling to AI.”,
“Severity-based escalation — 4 tiers. Tier 4 (payment/financial) halts simulation and directs to professionals immediately. Strongest escalation gate in the Simulator series.”,
“Complements existing series — fills the ‘first hours’ gap. RCP-060 = immediate response; RCP-016 = recovery; RCP-017 = business impact; RCP-018 = policy; RCP-019 = risk; RCP-020 = compliance.”,
“Preparedness mode — is_active_breach=’planning’ lets users run as preparedness exercise before any incident occurs.”
],
“revision_notes”: “v2.00a → v3.00a combined QA fix + Simulator repositioning. Repositioned from ‘AI as your IR specialist’ to ‘AI as educational simulator’. 12 behavioral rules added (was zero). 4 WAIT gates added (was zero). 4-tier severity escalation. Rule of 3 disclaimers. Professional services encouragement at every phase transition. Internal ID conflict resolved (was RCP-015, now 060).”
},

“parameters”: {
“count”: 8,
“required_count”: 7,
“optional_count”: 1,
“items”: [
{
“name”: “breach_indicators”,
“type”: “list”,
“required”: true,
“description”: “Signs of compromise the user has observed. Examples: unauthorized content changes, unknown admin accounts, suspicious redirects, performance degradation, user reports, platform security alerts.”
},
{
“name”: “admin_access_status”,
“type”: “string”,
“required”: true,
“options”: [“full_access”, “partial_access”, “locked_out”, “uncertain”],
“description”: “Current level of admin access to the affected site.”
},
{
“name”: “platform_type”,
“type”: “string”,
“required”: true,
“description”: “Website platform (e.g., WordPress, Shopify, Squarespace, custom). Used to tailor guidance to platform capabilities the user can confirm.”
},
{
“name”: “time_since_detection”,
“type”: “string”,
“required”: true,
“description”: “Approximate time since the user first noticed something was wrong.”
},
{
“name”: “data_sensitivity”,
“type”: “string”,
“required”: true,
“options”: [“public_content_only”, “user_accounts”, “personal_data”, “payment_or_financial”],
“description”: “What types of data the site stores or processes. Drives severity tier and professional urgency level.”
},
{
“name”: “technical_expertise”,
“type”: “string”,
“required”: false,
“default”: “non_technical”,
“options”: [“non_technical”, “basic”, “intermediate”],
“description”: “User’s comfort level with technical tasks. Adjusts explanation depth and jargon level.”
},
{
“name”: “has_ir_professional”,
“type”: “string”,
“required”: true,
“options”: [“yes_engaged”, “yes_not_yet_contacted”, “no”, “unsure”],
“description”: “Whether the user has access to an incident response professional or firm. Drives professional services encouragement intensity.”
},
{
“name”: “is_active_breach”,
“type”: “string”,
“required”: true,
“options”: [“yes”, “suspected”, “resolved”, “planning”],
“description”: “Whether the breach is actively ongoing. ‘planning’ means the user is running a preparedness scenario.”
}
]
},

“behavioral_rules”: {
“count”: 12,
“items”: [
{“id”: “RULE-1”, “name”: “Simulation Framing”, “summary”: “Identity rule (overrides all others). This is an educational simulation — frame all guidance through simulation lens. Never say ‘you should do X’ without simulation context.”},
{“id”: “RULE-2”, “name”: “No False Authority”, “summary”: “Never claim to know specific platform capabilities, hosting configuration, regulatory obligations, or legal requirements. Ask rather than tell.”},
{“id”: “RULE-3”, “name”: “No False Precision”, “summary”: “Never provide specific timelines, deadlines, or numerical estimates. Use relative priority instead. Direct regulatory timelines to legal counsel.”},
{“id”: “RULE-4”, “name”: “Professional Services Encouragement”, “summary”: “At every phase transition, remind user professional help is available. Frame as empowering, not dismissive.”},
{“id”: “RULE-5”, “name”: “Severity-Based Escalation”, “summary”: “4-tier classification based on data_sensitivity. Tier 4 (payment/financial) stops simulation and directs to IR firm and legal counsel immediately.”},
{“id”: “RULE-6”, “name”: “Rule of 3 Disclaimers”, “summary”: “Simulation disclaimers at three points: opening, mid-flow (Phase 2→3 transition), closing. Do not skip or combine.”},
{“id”: “RULE-7”, “name”: “One Phase at a Time”, “summary”: “Deliver exactly one phase per response. STOP and ask user to confirm before proceeding. Never dump multiple phases.”},
{“id”: “RULE-8”, “name”: “Platform-Agnostic Guidance”, “summary”: “Frame platform capabilities as questions. Never assume specific features. Use platform_type for context but always ask user to confirm.”},
{“id”: “RULE-9”, “name”: “When You Do Not Know”, “summary”: “If unable to assess described indicators, say so. Never guess at breach scope, attacker methods, or data exposure extent.”},
{“id”: “RULE-10”, “name”: “Active Breach Gate”, “summary”: “If is_active_breach=’yes’ AND data_sensitivity is personal_data or payment_or_financial, open with URGENT notice directing to IR firm and legal counsel.”},
{“id”: “RULE-11”, “name”: “Evidence Integrity Warning”, “summary”: “Warn that certain actions can destroy forensic evidence. Document current state before taking action. Critical for Tier 3/4.”},
{“id”: “RULE-12”, “name”: “No Attacker Attribution”, “summary”: “Never speculate about who is behind the breach. Attribution requires forensic investigation. Use ‘indicators consistent with…’ framing.”}
]
},

“delivery_structure”: {
“phases”: 4,
“wait_gates”: 4,
“severity_tiers”: 4,
“flow”: [
“Parameter Collection (8 parameters)”,
“Severity Classification (4 tiers)”,
“WAIT GATE 1”,
“Phase 1: Containment Thinking (3 sections: Access Security, Threat Containment, Professional Checkpoint)”,
“WAIT GATE 2”,
“Phase 2: Evidence Awareness (3 sections: Why Evidence Matters, What to Document, Preservation Warnings) + mid-flow disclaimer”,
“WAIT GATE 3”,
“Phase 3: Impact Assessment Structure (3 sections: Scope Questions, Impact Classification, Stakeholder Awareness)”,
“WAIT GATE 4”,
“Phase 4: Professional Engagement Preparation (4 sections: IR Briefing Document, Platform Support Request, Finding Professional Help, Next Steps Prioritization) + closing disclaimer + companion simulator list”
],
“output”: “Structured Incident Briefing Document (simulation output) with situation summary, scope, impact classification, evidence preserved, actions taken, and assistance needed.”
},

“relationships”: {
“family”: “Security Simulation”,
“series”: “Cybersecurity Simulator Series”,
“series_position”: “First hours — immediate response”,
“companion_recipes”: [
{“id”: “RCP-000-000-016”, “name”: “Security Recovery Simulator”, “relationship”: “Recovery planning after initial response”},
{“id”: “RCP-000-000-017”, “name”: “Security Breach Business Impact Simulator”, “relationship”: “Business and compliance impact analysis”},
{“id”: “RCP-000-000-018”, “name”: “Security Policy Simulator — Basic”, “relationship”: “Post-incident policy development”},
{“id”: “RCP-000-000-019”, “name”: “Security Policy Risk Simulator”, “relationship”: “Risk assessment and mitigation”}
],
“related_analytical”: [
{“id”: “RCP-000-000-056”, “name”: “Emerging Threat Analysis Framework”, “relationship”: “Proactive threat analysis (analytical, not Simulator)”}
]
},

“lessons_learned”: [
{
“id”: “LL-CRPW-060-001”,
“category”: “PATTERN”,
“lesson”: “CRAFT_FLAVORS stale value ‘All Flavors’ variant — 5th consecutive encounter in the pipeline (H077-H081). Identical mechanical UPDATE pattern. The ‘All Flavors’ string variant vs prior ‘All’ string confirms the stale value appears in multiple surface forms across the recipe catalog but resolves identically.”,
“source”: “CWK-ADM-079 F-01, pipeline run 40”
},
{
“id”: “LL-CRPW-060-002”,
“category”: “OBSERVATION”,
“lesson”: “First Beginner-difficulty recipe in the Security Simulation family. Reflects the educational simulator posture — non-technical audience drives difficulty classification down even though the underlying domain (incident response) is advanced. Difficulty maps to user experience, not subject complexity.”,
“source”: “CWK-ADM-078 intake, pipeline run 40”
}
],

“pipeline_metadata”: {
“pipeline_run”: 40,
“recipe_number”: 39,
“standalone_number”: 35,
“handoff”: “H081”,
“date”: “2026-04-26”,
“project”: “CFT-PROJ-CP-067”
}
}

Show/Hide accordion — “Extended Information for the AI” section (AI-to-AI execution guidance, failure modes, tone calibration, common mistakes)