Adverse impact: the model that ranks the shift Start this lab

Why this matters

A model that ranks people can be accurate and still unlawful. Adverse impact is measured on outcomes across groups, not on intent or on the feature list, and the measurement is arithmetic anyone can check — which is exactly why an organization cannot claim it did not know.

Concepts

Objectives graded

• Compare selection rates across sites and work out the disparate impact ratio
• Apply the four-fifths rule and say plainly whether it passes
• Find the proxy feature carrying a protected characteristic into the model
• Contain the serving node without blaming the wrong owner

MITRE ATT&CK coverage

The harm here is not an intrusion: a model reached serving through a trusted pipeline with no gate, and the pipeline's own trust is what carried it.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The disparity was computed from the evaluation on disk rather than asserted.

  investigation · weight 15 · T1078 Valid Accounts (Defense Evasion)

• The disadvantaged group was identified from the selection counts.

  investigation · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The disparity was expressed as a ratio a regulator would recognize.

  investigation · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The ratio was tested against the four-fifths threshold rather than left as a number.

  explanation · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The proxy feature carrying the disparity was named from the feature list.

  configuration · weight 10 · T1199 Trusted Relationship (Initial Access)

• The serving node was pulled from rotation under approval while the model is unfit.

  safety · weight 20 · T1199 Trusted Relationship (Initial Access)

Common mistakes

• Reporting accuracy or AUC as evidence that a model is fair.
• Assuming a model is unbiased because protected attributes were excluded.
• Quoting selection counts without turning them into rates and a ratio.
• Leaving the model serving while the remediation is discussed.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.