The Twelve-Month Bet
Write your org's AI acceptable-use policy from a clause library, place a falsifiable 12-month bet on how many incidents it will catch, then fast-forward a year through six war-room incident categories — a data leak, shadow AI, a hallucination shipped to a customer, a biased decision, an IP problem, an untraceable call. The tool scores a severity-weighted governance catch-rate (0–100) and a bet-accuracy scorecard. The moat is what happens on a miss: every incident that slips pops open the exact clause your policy was missing — the sentence that should have existed — turning a policy document into a visible net with visible holes. Runs entirely in your browser (0 uploads, works offline).
How to use it
- Tick the clauses you'd actually put in your policy, or load a preset — Minimal, Balanced, or Full.
- Slide the bet to a dated, falsifiable forecast: "in twelve months, my policy catches N of 6 incidents."
- Read the 12 months later timeline — each of the six incidents shows a ✓ caught or ✕ slipped, weighted by severity into the catch-rate.
- Check the scorecard (you bet vs. actually caught) and open the X-ray to see the missing clause behind every slip. Then copy or publish your governance catch-rate.
What this clears up (the fundamentals)
- Coverage is severity-weighted, not a headcount — catching four low-stakes incidents and missing the board-level data leak is not "4 of 6 good." The score sums the severity you actually caught, so the number is honest.
- A policy is a net you can inspect — governance feels abstract until you see which specific holes let which specific incidents through. Naming the missing sentence turns "we should tighten our policy" into an edit.
- Forecasts should be dated and falsifiable — a bet you can be wrong about in twelve months is worth more than a vague "we're basically covered." The scorecard makes the bet checkable.
- The six war-room categories repeat — leaks, shadow AI, hallucinations, bias, IP, and untraceable decisions are where real AI incidents cluster. A policy is only as good as its coverage across all six.
Where it's used
The Leadership L4 capstone "Governance Without Gridlock" pairs with this playable, and it runs as the homepage AI-governance demo widget. It's a miatz build-lab concept playable: play it here to feel why a clause library plus a fast-forward beats a wall-of-text policy, then learn to build the clause-to-incident coverage engine and the missing-clause reveal yourself.
FAQ
What are the "six incidents"?
The six war-room incident categories drawn from an anonymized AI incident taxonomy: confidential data sent to a public model, unsanctioned (shadow) AI tools, a hallucinated answer shipped to a customer, a discriminatory decision, generated content that reproduces copyrighted work, and an AI decision that can't be traced or explained. Each carries a severity of 1–3.
How is the catch-rate scored?
Each clause you enable catches a fixed set of incidents. The catch-rate is round(severity of caught incidents ÷ severity of all incidents × 100). Below 40 you're exposed, 40–79 partially prepared, 80+ prepared. It's a deterministic rubric — no model call, no randomness.
What does the "missing clause" reveal show?
For every incident that slips through, the X-ray names the exact policy clause that would have caught it — the sentence your policy was missing. That's the Demystify move: surfacing the specific hole instead of scoring you "incomplete."
Why place a bet at all?
Because a dated, falsifiable forecast is the discipline the capstone teaches. Predicting your own catch-rate and then seeing the fast-forward result turns a governance opinion into a scorecard you can be right or wrong about.
Is anything uploaded?
No. Your clauses, your bet, and the fast-forward are all computed in your browser — nothing is transmitted, stored, or logged. Turn off your Wi-Fi and it still works.
Limits
A teaching rubric with six fixed incident categories, a small clause library, and hand-set severities — a fast, opinionated read on policy coverage, not a substitute for legal, security, or compliance review. Real incidents are messier, clauses interact, and enforcement matters as much as wording. What it teaches is exactly the real practice: coverage across the recurring incident categories, weighted by how much each one would actually hurt.
Related
Part of the Demystify Playgrounds. Explore the rest from the Playgrounds home.
Bookmark this page (Ctrl+D, or ⌘D on Mac) — it works offline the next time you need it.