Professional Competency Paths

The previous lesson measured authority as a document: how many items it defines with a single meaning, how many it opens to dispute, and how many paths it makes testable. Once the text is written, the work becomes executable; what remains is how the person able to do that work is told apart.

An organization hands this question to three separate measurements. A multiple-choice certification measures recognizing an answer in an exam room. A practical exam measures reaching an end state within a set time. A lab environment lets a person work through a setup they build themselves, one with no real consequence, again and again. All three measure something, but not the same thing. This lesson separates the three on a single question: how many of the competency items this course requires do they measure.

Writing Competency as an Item

• FR25. The competency set is 15 items, drawn from the work the course’s fifteen lessons genuinely required: counting paths, adding a layer, narrowing privilege, choosing which step to cut, and the like.
• FR26. Each item has three properties. Form: is the item demonstrated by knowledge (k) or by practice (p). Single meaning: is there a single correct end state that can be tested. Consequence: does getting it wrong carry a real cost — legitimate work stops, another team is affected.
• FR27. Multiple-choice certification measures only an item whose form is knowledge and which has a single meaning. The practical exam measures every item with a single meaning; it cannot grade one with no defined end state. The lab environment covers every item with no real consequence; an item with a real consequence does not occur in a lab.
• FR28. Each item’s path load is the number of paths, in this course’s 30-path model, that cannot close without that item. Loads can be summed, but the same path is counted under more than one item; the total is a load, not a distinct path count.
• FR29. The model is fictional; there is no real exam, certification, organization, or lab product.

// competency/measure.mjs — the 15 competency items this course requires and the coverage of the
// three measurement pathways (MODEL). There is no real exam, certification, organization, or lab.
// form: k = demonstrated by knowledge, p = demonstrated by practice
// single: is there a testable single correct end state | cost: does being wrong have a real cost
// path: in this course's 30-path model, the number of paths that cannot close without this item
const ITEM = `
  term-separation         k yes no  30
  risk-ranking            k yes no  12
  path-counting           p yes no  30
  layer-adding            p yes yes 22
  privilege-narrowing     p yes yes 17
  bulkhead-design         p yes yes 14
  default-review          p yes no   8
  log-analysis            p yes no   6
  incident-response       p yes yes  5
  environment-setup       p no  no   0
  step-selection          p no  yes 22
  legit-work-cost         p no  yes 22
  inventory-keeping       p no  yes 19
  scope-writing           k no  yes 22
  boundary-recognition    k no  yes  8`
  .trim().split("\n").map((r) => {
    const [name, form, single, cost, path] = r.trim().split(/\s+/);
    return { name, form, single: single === "yes", cost: cost === "yes", path: Number(path) };
  });

// Three measurement pathways, defined as predicates over item properties.
const WAY = {
  "multiple-choice": (k) => k.form === "k" && k.single,   // a recognizable single right answer
  "practical-exam": (k) => k.single,                       // a testable end state
  "lab": (k) => !k.cost,                                    // an item with a real cost does not occur here
};
const NAME = Object.keys(WAY);
const write = (g, ...s) => console.log(s.map((v, i) =>
  (g[i] < 0 ? String(v).padEnd(-g[i]) : String(v).padStart(g[i]))).join(""));
const load = (s) => s.reduce((a, k) => a + k.path, 0);
const TOTAL = load(ITEM), share = (x) => `${((x / TOTAL) * 100).toFixed(1)}%`;

console.log(`competency MODEL: ${ITEM.length} items, total path load ${TOTAL} ` +
  `(the same path is counted under more than one item; this is a load total, not a distinct path count).`);
const T = [-26, 18, 20, 16];
console.log("\n1. how many items each measurement pathway measures");
write(T, "measure", ...NAME);
for (const [ad, f] of [["item measured", (b) => `${ITEM.filter(WAY[b]).length}/${ITEM.length}`],
  ["path load measured", (b) => load(ITEM.filter(WAY[b]))],
  ["share of path load", (b) => share(load(ITEM.filter(WAY[b])))]]) write(T, ad, ...NAME.map(f));

const both = ITEM.filter((k) => WAY["multiple-choice"](k) && WAY["practical-exam"](k));
const onlyOne = ITEM.filter((k) => WAY["multiple-choice"](k) !== WAY["practical-exam"](k));
const none = ITEM.filter((k) => !NAME.some((b) => WAY[b](k)));
const union = ITEM.filter((k) => NAME.some((b) => WAY[b](k)));
const W2 = [-38, 10, 13];
console.log("\n2. where the two exam formats agree, where they diverge");
write(W2, "set", "items", "path load");
for (const [ad, s] of [["measured by both", both], ["measured by only one", onlyOne],
  ["measured by neither", ITEM.filter((k) => !k.single)],
  ["not covered by the lab", ITEM.filter((k) => k.cost)],
  ["measured by the three together", union], ["measured by none of them", none]])
  write(W2, ad, s.length, `${load(s)} (${share(load(s))})`);

console.log("\n3. items no measurement pathway measures");
write([-26, 8, 8], "item", "path", "form");
for (const k of none) write([-26, 8, 8], k.name, k.path, k.form);
console.log(`what these ${none.length} items share: no single correct end state, ` +
  `and being wrong has a real cost.`);

competency MODEL: 15 items, total path load 237 (the same path is counted under more than one item; this is a load total, not a distinct path count).

1. how many items each measurement pathway measures
measure                      multiple-choice      practical-exam             lab
item measured                           2/15                9/15            6/15
path load measured                        42                 144              86
share of path load                     17.7%               60.8%           36.3%

2. where the two exam formats agree, where they diverge
set                                        items    path load
measured by both                               2   42 (17.7%)
measured by only one                           7  102 (43.0%)
measured by neither                            6   93 (39.2%)
not covered by the lab                         9  151 (63.7%)
measured by the three together                10  144 (60.8%)
measured by none of them                       5   93 (39.2%)

3. items no measurement pathway measures
item                          path    form
step-selection                  22       p
legit-work-cost                 22       p
inventory-keeping               19       p
scope-writing                   22       k
boundary-recognition             8       k
what these 5 items share: no single correct end state, and being wrong has a real cost.

The first table lines the three pathways up by coverage. Multiple-choice certification measures 2 of the 15 items and covers 17.7% of the total path load. The practical exam covers 9 items and 60.8% of the load. The lab environment covers 6 items and 36.3%.

The gap between the two exam formats is not a difference of degree. The two items multiple-choice certification measures — term separation and risk ranking — sit inside the nine the practical exam measures. The second table’s first row writes this: the intersection is 2 items, the divergence is 7, and all seven of the diverging items sit on the practical-exam side. These two measurements are not siblings; they are nested: one measures a narrow subset of what the other measures.

What the Lab Does Not Cover

The lab environment diverges on a different axis from the two exams. Which items it covers is not chosen by whether they have a single meaning, but by whether they carry a consequence. The not covered by the lab row writes 9 items and 63.7% of the total load.

The reason is in the lab’s own definition. A lab environment carries no legitimate traffic; no one uses the billing system, so a wrongly cut step never stops anyone. There is no other team; a handoff done or skipped never has a consequence. There is no scope; stepping outside a boundary carries no cost. A lab is an environment where being wrong is free, and that is exactly why it cannot measure items that carry a cost. The lab’s value is in repetition, not in the reality of the outcome.

Taken together, the three cover 10 items and 60.8% of the load. The lab’s only addition is environment-setup, and its path load is 0: the lab contributes the most on the item that carries the least path load.

The Five Items Nothing Measures

The third table is this lesson’s central finding. The three measurement pathways together never measure 5 items, and these five carry 39.2% of the total path load.

What the five share is in the output’s last line: no single correct end state, and being wrong carries a real cost. The two properties together push an item outside all three measurements at once. With no single correct answer, it cannot be graded; with a real cost, it does not occur in a lab.

Reading the items one by one sharpens the table further. step-selection and legit-work-cost are this course’s two central jobs, and both carry 22 paths: what gets measured from this course’s first lesson to its last is which step gets cut and how much legitimate work that cut stops. inventory-keeping carries 19 paths — the count of paths the defense did not know about in the first lesson. scope-writing carries 22, boundary-recognition 8. All five are items this course measures; none of them are items this course can be assessed on.

This does not mean the three pathways are worthless. Certification genuinely measures term separation, and without term separation no path can be named; the practical exam covers 60.8% of the load, and that is no ordinary threshold. The measurement says only this: the area a competency measure does not cover does not mean that measure is invalid; it means that area stays unmeasured. A certificate or an exam result carries exactly as much information as the path load it covers — no more, no less.

Matching the Measure to the Role

When the three pathways’ coverage is dropped onto the five roles separated in the second lesson, the question turns into one of matching. The ten items measured are weighted heavily toward the close duty: adding a layer, narrowing privilege, designing a bulkhead, running an incident. The five unmeasured items fall into the track and sustain duties: keeping the inventory, writing the scope, recognizing the boundary. The same gap that turned up separately in two lessons is here again: every one of the responsibility matrix’s seven unowned cells sat in these same two columns, and here too the five unmeasured items in the competency count fall into the same two columns. Organizations know how to both name and measure the hand that does the work; naming and measuring the hand that keeps the list and checks the outcome is the part they skip in both.

The practical takeaway is not a ranking — it is a pairing. A practical exam shows that a candidate can do the work of cutting; it does not show which step should be cut or how much legitimate work that cut will stop. Those two items are purple work itself, the very thing the first lesson measured: it shows up only when the defense and the testing side walk the same set of paths together, and there too it is measured not by an exam score but by the ratio of closed paths to stopped legitimate requests. The unmeasured part of competency is not unmeasurable; it is measured on top of the work itself, with this course’s own three columns.

Summary

• In the 15-item competency set, multiple-choice certification measures 2 items, the practical exam 9, and the lab environment 6; the path-load share they cover is 17.7%, 60.8%, and 36.3% respectively.
• The two exam formats are not siblings, they are nested: the intersection is 2 items, the divergence is 7, and all seven diverging items sit on the practical-exam side.
• The lab environment does not cover 9 items, and they carry 63.7% of the total load. The reason is the environment’s own definition: with no legitimate traffic, no other team, and no scope boundary, being wrong carries no cost.
• The three pathways together measure 10 items; the lab’s only addition carries a path load of 0.
• The 5 items no pathway measures carry 39.2% of the load, and what they share is identical: no single correct end state, and being wrong has a real cost. Two of them are this course’s central jobs, and each carries 22 paths.

Course Wrap-Up

Lesson	How many paths	Closed paths	Legitimate-work cost
Confidentiality, Integrity and Availability	8 assets × 3 axes	6 decisions: 27 increases, 22 decreases	confidentiality −6 in the net-zero decision
Asset, Threat and Vulnerability	19 valid out of 576 triples	5 vulnerabilities, 12 triples	3, 2, 1, 0 triples as the zone narrows
Risk Definition	12 items, 176.05 units	4-item budget, 77.00 units	9.40 units by scoring format
Exploit and Payload	12 chains, 53 steps	single step, up to 8 chains	middle steps broken, 1 chain remains
Attack Surface	35 paths, 21 edges	first three removals 68.6%	7 jobs, 24 jobs for the remaining 4 paths
Defense in Depth	55 paths	52 close, 3 remain	63 managed items, 1,793 extra steps
Least Privilege	55 paths	43 paths, 15 free	from 11 requests a day to 3,502
Isolation	14 nodes, 4 assets	assets reached 4 → 2.8	20 gateways, 3,513 requests a day
Zero Trust	55 paths	5 by location, 35 at every step	7,019 verifications a day, +2.00 steps
Authentication and Authorization Distinction	55 paths, two request types	0 at the wrong layer, 35 at the right one	2.57 per request; 0 paths at +1.43 steps
Secure Defaults	22 items, 20 paths	one forgotten item opens 12 paths	319 a day when closed, 1,440 at worst
Blue, Red, and Purple Teams	30 paths	17 → 22	from 2,764 requests a day to 2,037
Security Roles	30 paths	28 → 30	from 2,321 requests a day to 2,135
Legal Framework and Ethics	30 paths	8 → 22 testable	4,607 requests a day, 4 windows
Professional Competency Paths	237 path load	144 measured (60.8%)	5 items, 93 load unmeasured

The course’s rule is the same across all fifteen rows: defense is not a list of prohibitions; it is the narrowing of a countable set of paths, and a defense whose cost is never written down counts as unmeasured. Without the middle column, the left column is an inventory listing; without the right column, the middle column is a claim of success.

The right column collapses into four families across the fifteen rows. Legitimate work stopped repeats in six lessons (least privilege, isolation, secure defaults, and the last three): the cost lands directly in front of the user, which is why it is the family noticed fastest. A step added to every request shows up in three lessons (defense in depth, zero trust, authentication versus authorization): unnoticed, but paid on every single request. A manually managed item shows up in three lessons (63 managed items, 20 gateways, 4 test windows): no one counts it until an incident happens. A cost stated as a raw number appears in the first four lessons, measured before the path unit even existed.

The left column tells its own story. The first four lessons never use the path unit at all: what gets counted there is an axis, a triple, an item, a chain. The unit is established in the fifth lesson and never changes across the ten lessons that follow. The path count itself is not constant, though — 35, 55, and 30 — because the number depends on how the graph is drawn, how many entry points and how many targets are defined. A path count is not a fact; it is a model’s output, and for it to be comparable, the graph itself has to be written down too.

The middle column, in two lessons, writes that defense falls short. Defense in depth closes 52 of fifty-five paths, and the remaining three paths are the legitimate channel itself: adding a layer does not close them. Zero trust verifies at every step and leaves twenty paths open, and the source of those twenty paths is not a missing control — it is the design of four internal flows. A set of paths is never zeroed out; what gets written is why what remains, remains.

Paths were counted, principles were measured, and who measures within which boundary was written down. Still, all fifteen of these lessons treated paths as abstract nodes and steps. M24/K02 Information Technology and Systems Fundamentals opens that abstraction: what components build the machine itself that every one of these paths runs across, what boundary an operating system draws between one user and another, how a file permission can cut a step, and how sturdy a wall virtualization puts between a guest and a host.