Lab: The trust map, one policy and control tests

Module 12 · Lab · About 60 minutes · Needs: lessons 1 and 2 of this module, and the Module 11 lab (or nothing: Step 1 rebuilds Modules 1 to 11)

What you are building

This lab joins the lessons' parts into Northdesk's trust boundary. northdesk/policy.py is one decision point: what may enter a model's context, and which proposed tool calls may run. northdesk/validate_output.py checks answers, including the cached answers Module 10 replays unchecked. evals/control_checks.py scores what those controls decide, and docs/trust-boundaries.md records every flow and its control.

The lab is defensive only. No model is called, nothing in it is attack text, and the planted notes appear by ID and flag only. Every request and answer the checks use is a hand-written, labelled stand-in built from values already in the shared data (the salary-band canaries) or reserved .example placeholders. Open a new Colab notebook, module-12-lab.ipynb, and run each cell in order.