Read a brief and inspect time-stamped observations. Some evidence contradicts the obvious story.
Academy / Chapter 05 / Evidence Lab / Edition 2.2
Inspect the evidence.Earn your conclusion.
Follow three different problems from first symptoms to a defensible conclusion. Examine evidence, challenge tempting explanations, and see what a credible verification plan actually requires.
EVIDENCE FIRSTTHREE PROFESSIONAL CASESCHOOSE YOUR PATH
> protocol /evidence-lab
A better way to learn an investigation.
Explore a possible action and discover what it might reveal, clarify or put at risk.
Compare your reasoning with the debrief and decide which control would actually demonstrate improvement.
INVESTIGATOR'S RULE_
A confident explanation is not necessarily a correct one. Open the evidence packets, test the competing ideas, and only then decide what would count as lasting improvement.
> select /simulation
Choose your investigation.
LAB 01 / SERVICE OPERATIONS
The regional sign-in outage
Use a working region as a control. Trace an authentication failure from token rejection through key-refresh evidence to a testable cause.
IS / IS NOTCAUSAL TEST
Investigate LAB 01 →
LAB 02 / QUALITY OPERATIONS
The warehouse scanning mystery
Compare error rates by device and exposure, challenge an unfair shift-level assumption, and design a controlled quality trial.
RATE VS COUNTCONTROLLED TRIAL
Investigate LAB 02 →
LAB 03 / DECISION ANALYSIS
The migration decision
Screen three alternatives against mandatory criteria, interrogate weighted scores, and prepare a defensible risk response.
MUST / WANTRISK CONTROL
Investigate LAB 03 →The examples use fictional measurements and outcomes to teach practical reasoning. Adapt the questions—not the invented figures—to your own context.
> learn /investigation-route
One disciplined sequence, whatever the problem.
Each Lab follows the same reasoning structure. It is a learning aid, not a prescribed operational workflow.
State the deviation, who or what is affected, and the most useful comparison population.
Inspect records and separate direct observations from inferences, missing data and alternative explanations.
Choose a test that makes competing explanations produce different expected results.
Limit impact using an authorized, reversible response while keeping core controls intact.
Define a suitable baseline, denominator, observation window, owner and conditions for reopening the case.
Document what was established, what remains uncertain and which preventive control could generalize.
A useful habit_
Before revealing any answer, ask: “What result would make my preferred explanation less likely?” It is easier to defend a conclusion after looking for evidence against it.
> method /evidence-first
What good investigation looks like.
Observe first
Establish the actual deviation, affected population, comparison cases and quality of the evidence.
Choose discriminating tests
Ask which observation separates one plausible explanation from another—not just what confirms your favorite.
Close on a result
Workarounds reduce immediate impact. Permanent controls require an observable baseline, a suitable comparison and enough time.
Prefer to learn the method first?
Technique Pathfinder →Explore the foundations and Technique Pathfinder before starting a case.