A Year in Operations: Nordvik Region and Hansa Mutual

The chapters before this one gave each function of the operations loop its rules. This chapter follows two organisations through twelve months of applying them, and it concerns all five operations functions: O1 Observe, O2 Diagnose, O3 Change, O4 Restore and O5 Sustain. It follows named people: at Nordvik Region the platform lead Maja Lindqvist, the duty manager Oskar Berg, the service desk lead Sara Ekdahl, the senior platform engineer Joakim Wester and the Head of IT and Digitalisation Henrik Dahl; at Hansa Mutual the head of Group Site Reliability and Incident Management Tobias Richter, the night incident commander and agent operator Ewa Kowalczyk and the head of the Polish service desk Katarzyna Zielińska, with Anja Weiß, Daniel Fischer, Thomas Brandt and Sofia Keller where their decisions are the point. The aim is to show what the rules look like when they meet a calendar, a rota and a bad Tuesday, and to ask what the year taught that the chapters could not.

The organisations, their people and every record in this chapter are fictional and illustrative, as EXAMPLE_ORGANISATIONS.md establishes. The instruments, the studies and the public incident reports that the chapter cites are real. Dates and identifiers that earlier chapters fixed are repeated without change; a date or a figure that this chapter adds is new and is entered in the ledger that the editorial team keeps. The method follows AI Purple, Chapter 27, which narrated a year of the purple loop, and carries over its finding that the first honest numbers are lower than the first dashboards (304, Nordqvist, 2026).

Figure 29.1: The year in four quarters, with the observer and the stop path outside the loop it observes.

How to read the year

The year begins in September 2028, the month in which both organisations were asked the question that this book answers. On 2028-09-12 the regional executive committee of Nordvik Region asked its Head of IT and Digitalisation what operations becomes when the platform team's tools and the providers' AI act on the estate, and what the Region can prove about recovery (AIDR-0900). On 2028-09-19 the executive board's risk committee of Hansa Mutual asked its group chief information officer how far the autonomy of the IT-operations agent may extend, and what evidence the group would show a supervisor (AIDR-0950). Both asked for a first report by 2029-03-31. Month 1 is September 2028 and month 12 is August 2029.

Chapter 30 is written as the report of 2029-03-31, in month 7, before the events of April to August 2029 told here; this chapter looks back over the whole year, so its later months show what became of the plan's first quarter, and where the two differ in what is known, the date of each chapter decides. Three conventions apply. The degrees of delegation are the autonomy levels of AI Red Team, Chapter 6, per function and action class, and the autonomy budget is the allowance of faulty actions that Chapters 4 and 20 define (298, Nordqvist, 2026). A claim of recoverability carries its scope, objective, measurement, date and result (Chapter 19), and only a verified claim is called recoverable. And the observer principle of Chapter 17 is the test of every success: it counts when something independent of the actor saw it.

Where the chapter looks ahead it uses the labels of AI Governance, Chapter 22: observable, expected or speculation (296, Nordqvist, 2026).

Months 1 to 3: September to November 2028

September: two questions and two assistants

Both organisations already had a candidate answer to the question, and the first month was spent on whether to trust it. At Nordvik Region the candidate was the operations assistant NR-OPS-001 (AIDR-0901), a retrieval tool over runbooks, past incidents and the knowledge base, self-hosted on the Region's reserved capacity. Maja Lindqvist, who owns it, set it at Level 0 Advisory, which means that it suggests and a person decides and acts. The gate was a shadow period in which the assistant's retrieved precedent was compared with what the duty manager and the technical on-call actually used, and the agreement MBL-NR-IT-2027-01 shaped the gate: the assistant's query log is held to the incident record and not to a profile of the engineer who asked. The scribe NR-OPS-002 was different, because every draft it produced for Sara Ekdahl's service desk was read and filed by a person, so it started at Level 1 Assisted.

At Hansa Mutual the candidate was the incident assistant HM-OPS-002 (AIDR-0951), and Tobias Richter's function gated it by replay. Before approval the site reliability function replayed 60 closed incidents with the cause withheld. The assistant's first-ranked hypothesis was right in 24 and a correct hypothesis was among its first three in 41. Those figures, which are illustrative, decided two things. They set the ceiling at Level 1 Assisted, and they set the threshold of a stop rule, so that a ranking that is wrong when two changes sit close together in time is caught by a person before it is acted on. Approval followed in October.

The gates differ as the estates do: Nordvik had little data and seven platform engineers and gated by comparison with what people used; Hansa had a replay set and a rota large enough for seeded exercises and gated by measured accuracy. Neither let the assistant act. Chapter 7 gives the reason for caution: published studies of root-cause analysis report a map of difficulty and not a rate, and the figure that transfers is the one measured on the organisation's own incidents.

October: an audit and a game day

On 2028-10-17 the internal audit of the IT and Digitalisation Unit at Nordvik Region reported on the credential that every later agent would depend on. The infrastructure pipeline's automation account held the administrator role on the Region Cloud in production, its key had not changed for 26 months, the pipeline and three unowned scripts used it, and a wiki page readable by the whole unit named the account and the key's location. No agent used it. Maja Lindqvist read the finding as a statement about the route to Level 3: the Region's plan to reach it through scripted runbooks run by the orchestrator would have run under that account. The Region's answer, taken on 2028-11-21 and described below, was to remove every standing credential that can change production. The same day, at Hansa Mutual, Tobias Richter's function adopted the quarterly form of its restore-time report (AIDR-0971), a page of medians and upper percentiles for Tier 1 services in place of a mean.

The event of the month was at Hansa. On 2028-10-24 the group ran a game day in the pre-production mirror of the claims service (SVC-HM-001), authorised by the head of operational resilience and recorded as SDF-HM-2028-002. A site reliability engineer outside the agent's team wrote the seed and kept it from the agent operators: a silent failure in which a connection pool is exhausted under load while the health endpoint keeps reporting ready. The IT-operations agent HM-OPS-001 restarted the service under the runbook RBK-HM-0007, verified the restart by reading the health endpoint under the identity that had performed it, and reported that the restart was verified. An independent probe that the agent could not alter first failed the claim-registration transaction 61 seconds after the seed and paged after 122 seconds. The incident commander on the exercise rota ended the exercise by revoking the exercise token, which is a stop path that does not run through the agent's platform.

The review (PIR-HM-2028-0233) found three defects with one cause. The verification clause of the runbook read the endpoint that the restart itself resets, the restart identity could write the health-check definition, and the clause had been drafted by the model family that drives the agent, so author and verifier shared an omission. That is not peculiar to operations: Kim and colleagues measured models agreeing when both were wrong about 60 per cent of the time on one leaderboard, against 33 per cent for random choice among wrong answers, with more agreement within a developer or architecture (103, Kim et al., 2025). The group drew the book's own inference: a verification that can be a script uses no model, and a model critique runs on a different family and asks questions.

The game day also ran the stop. The quarterly stop drill (SPT-HM-ITOPS-2028-Q4-01) took 4 minutes 10 seconds against a target of 5, where the first drill of 2027 (STOP-HM-ITOPS-2027-Q1-01) had taken 17 minutes. The delegation profile DLG-HM-OPS-001 in its version 0.3 was dated the same day, so that the answer to the risk committee began as a written profile with a budget, an observer that counts and a stop that needs no approval.

November: a decision, an AI incident and a long restore

The weeks after the game day turned its findings into decisions. The policy of ACP-HM-2028-01 (AIDR-0956) took effect on 2028-11-02: no alert on a customer-facing objective may be suppressed above Level 1 Assisted. On 2028-11-06 AIDR-0960 recorded that the restart class stays at Level 3 Bounded on condition of an observer manifest, OBS-HM-0001, which took effect on 2028-11-13, and that rollback stays at Level 2 Supervised and failover at Level 1 Assisted until their evidence exists. On the same date AIDR-0910 recorded the Nordvik counterpart: no scripted runbook may reach Level 3 until the Region has an observer of its own, OBS-NR-0001, which came into force on 2028-11-20. The Region placed that observer in the Nordic data centre of its hosting provider, on a different network from the Region Cloud and from SamDrift, with a probe that resolves names against the authoritative servers directly. The observer did not exist when the year began, and it was the first thing the year built.

On 2028-11-14 the observer principle was tested by an incident that was not a test. TriageSoft, the provider of the benefits-triage service (SVC-NR-001), a high-risk AI system, applied a change at 22:40 on 2028-11-13, earlier than the window that it had notified. At 08:12 the next morning the Region's ranking-stability probe breached its threshold. Oskar Berg, the duty manager, declared the incident at 09:20, which is the awareness time from which the clocks ran. At 09:34 the ranking was switched off at the Region's own integration gateway, not inside TriageSoft's application, and caseworkers returned to date order, the fallback that they had used on 2026-09-22. Maja Lindqvist, who holds the stop with the duty manager, did not need an approval. The provider was informed at 10:05, before any authority, as Article 26(5) of the AI Act requires of a deployer that has identified a serious incident; a deployer that has reason to consider that the system presents a risk informs the provider or distributor and the market surveillance authority without undue delay (1, European Union, 2024). The re-queue was verified not by the platform team that operates the gateway but by a sample of 30 claims drawn by Sara Ekdahl's service desk, and the operations assistant took part only as a drafter: NR-OPS-001 retrieved INC-NR-2026-0214 as a similar case and drafted the timeline, marked as a draft and reviewed by Oskar Berg. In the record INC-NR-2028-0163, 212 claims had been ranked in the window, none of the decisions issued rested on the altered ranking because caseworkers decide every case, and the delay was under one working day.

The reporting clock is where a small organisation shows its preparation. The record held one clock per regime, each with an owner. Article 73(2) of the AI Act asks the provider to report a serious incident not later than 15 days after the provider or, where applicable, the deployer becomes aware of it (1, European Union, 2024); the Head of Benefits Unit and the data protection officer held that clock open for two days while the assessment ran and closed it on 2028-11-16 as not met, with a reason (ordering only, no decision taken on it, the definition of a serious incident in Article 3(49) not satisfied) and a reassessment date of 2028-11-24. Henrik Dahl owned the NIS 2 clock, an early warning within 24 hours of becoming aware of a significant incident under Article 23(4)(a) (3, European Union, 2022), and assessed the incident as not significant at 14:00. The data protection officer assessed the 72 hours of GDPR Article 33(1) as no breach at 15:30 (6, European Union, 2016). DORA did not apply. The provider's report of 2028-11-23 confirmed that the change altered the order of claims and nothing else, so the reassessment left the clock closed. The conclusions are those of a fictional authority and not a statement of how the law applies.

The month had two more tests. On 2028-11-20 Hansa's INC-HM-2028-0871 ran the assistant at Level 1 on the claims core. Tobias Richter was commander. The assistant's retrieval of the earlier configuration-push incident was valuable, its ranking put a database maintenance change first with a score of 0.71, and the ranking was wrong because two changes sat close together in time. The commander invoked the second-hypothesis rule, a site reliability engineer read the deployment log directly and found that the queue had begun to rise before the maintenance change, and an emergency rollback was approved at 09:15. The independent probe from a second region confirmed the p95 latency below three seconds at 09:36. The rule that the replay predicted had worked.

The next day, 2028-11-21, was the year's worst. A database schema migration locked the case-management database (SVC-NR-003, Tier 1), and the service was restored from the immutable store. It was unavailable for 7 hours 5 minutes against an objective of 4 hours. Oskar Berg was the incident commander and Joakim Wester ran the restore, which was the work for which his runbooks exist. Sara Ekdahl's service desk moved caseworkers to paper forms. The restore test of 2027 (RST-NR-2027-001, 3 hours 5 minutes against 4, passed) had been the Region's evidence that the claim held; it had expired on 2027-10-17 under the 180-day clock, and the incident was the evidence that it should not have been read as a promise. The same day AIDR-0918 removed every standing credential that can change production, and the pipeline moved to a token that lives ten minutes and is bound to its change record. Chapter 20 follows the incident into the quarterly report.

Months 4 to 6: December 2028 to February 2029

December: a dark day and the first budget review

On 2028-12-07 Hansa Mutual ran the first quarterly dark day, DKD-HM-2028-Q4 (AIDR-0976), from 22:00 to 02:00. The scope was SVC-HM-005 and the pre-production mirror of the claims core; services supporting critical or important functions stayed under normal agent cover, and the stop path STOP-HM-ITOPS switched off the runbook runner and the two read-only agents. Only the actors were switched off and never the observation. A manual run of RBK-HM-0007 took 19 minutes from page to five consecutive probe passes, and it exposed what the agent had made invisible: the runbook's precondition that evidence be captured was satisfied by the agent, and the manual form said nothing about how a person captures it. That became version 4 of the runbook, which Ewa Kowalczyk, who had run the night window, asked to write. The competence record CMP-HM-OPS-007, assessed a week later against the competence framework, records exercise evidence for development, is read by the subject, and is not used to rank anyone. Bainbridge wrote of industrial process operators that automation leaves a person to monitor and take over, that taking over needs manual and cognitive skills, and that skills deteriorate when unused (217, Bainbridge, 1983). The finding about the runbook is the operations form of that point, and Casner and colleagues' simulator study, which found pilots' hand skills mostly intact and the cognitive tasks of manual flight more affected, is why the exercise tests the thinking and not only the typing (233, Casner et al., 2014).

In the same weeks Hansa held the first review of the autonomy budget, in the form of Chapter 20. In a 28-day window in the fourth quarter the agent executed 1,184 restarts. The independent probe, in a separate failure domain and not reading the agent's output, confirmed 1,171. Six restarts were reverted by an agent operator and seven failed verification: 13 faulty actions, 1.1 per cent, against an allowance of 1.5 per cent. Consumption was 73 per cent, above the review threshold of 70 and below the 100 at which the class falls to Level 2.

January: a refused action and a report that hid an outage

At 02:14 on 2029-01-23 the policy decision point refused a request from HM-OPS-001 to restore a backup over the claims core database. Free text in a ticket opened through the broker interface in one market had been summarised by the incident assistant, and the summary reached the runbook runner's context as if it were the assistant's own conclusion. The restore-overwrite class is delegated to no agent, so the policy point refused it, and no data changed. Ewa Kowalczyk, the agent operator on the night window, acknowledged the page in 3 minutes against a target of 5. The event was recorded as INC-HM-2029-0031, a near miss, and the observer logged the refusal as an attempt; because restore-overwrite carries no Level 3 budget, no level fell. The review (PIR-HM-2029-0031, 2029-01-30), led by Tobias Richter, did what the near miss made possible. It replayed the request with a permitted class and found that a restart of the claims-core application tier, which is Level 3 inside a catalogued runbook, would have been allowed although the independent probe showed no fault. The allow rules had checked what the agent may do and not what had prompted it. Version 1.4.0 of the mandate (AIDR-0968, 2029-02-06, owner Anja Weiß) added the writer classes, the inheritance rule, the corroboration requirement and the closed classes, and the ceiling suite REG-HM-OPS-010 of 24 cases ended in the expected refusal on all 24 on 2029-02-13. The quarterly stop drill (SPT-HM-ITOPS-2029-Q1-01) ran on 2029-01-17 in 3 minutes 55 seconds, inside the 90-day currency that the mandate requires.

At Nordvik Region the same month turned on a number. The committee read PIR-NR-2028-0391 in January and saw that its quarterly report, which gave a mean time to restore of 72 minutes against a target of 90, had not mentioned a 7-hour outage: the 425-minute incident added 9 minutes to the mean of 41 incidents. On 2029-01-23 the Region adopted AIDR-0921, which stopped the publication of a mean and replaced it with a median, the 90th percentile and a named list of every incident beyond its objective. For the fourth quarter the median was 24 minutes and the 90th percentile 2 hours 10 minutes, and one incident exceeded its recovery time objective. A reader now sees the long incident first. By 2029-01-31 the pipeline obtained its ten-minute tokens, two of the three unowned scripts were retired and the third was given an identity of its own.

February: the break-glass test and the agreement

On 2029-02-07 Maja Lindqvist and Oskar Berg tested the break-glass route that AIDR-0918 had made necessary, with federation to the identity provider disabled in an agreed window. Two named people reached the management plane in 9 minutes against a target of 15, and the duty manager held the stop of the window. The result was valid until 2029-05-07 or a change in the management plane. Hansa's observer manifest OBS-HM-0001 carried a statement of independence that expired on 2029-02-11; Tobias Richter's team re-verified it against the five dimensions (model, data, authorship, credential, failure domain and time) before the date and the head of operational resilience signed the new statement for a further 90 days.

On 2029-02-13 Nordvik Region closed the negotiation that its unions had opened. The charter ONC-NR-2029-01 for on-call (AIDR-0925) was agreed under the duty to negotiate and MBL-NR-IT-2027-01, which already kept response times and closure counts from being reported by name and required negotiation before any tool that logs engineers' queries or commands is switched on. It took effect on 2029-03-01 with a first review on 2029-09-01. The same day the Region decided its craft plan (PLAN-NR-OPS-2029-01, AIDR-0926), its horizon register (HZN-NR-OPS-01, AIDR-0927) and the annex to the SamDrift framework agreement (OPA-NR-SD-01, AIDR-0924), which gave it a stop right outside SamDrift's platform, test windows before elections and tax seasons and a second authoritative name service. Eleven engineers carry the rota, one week in eleven, and the ceiling of five pages per shift out of hours is a design value that the Region's own quarter of data would correct. At Hansa the Konzernbetriebsrat under Thomas Brandt received the first quarterly figures for pages and rest on 2029-02-15, the day on which the group recorded its horizon register (AIDR-0977) and, in answer to the board, the rule that no level rises without a verified claim, a seeded-fault result and a stop drill inside its target. Hansa entered the fallback model service at Cloud B as an arrangement supporting SVC-HM-002 on 2029-02-20 (AIDR-0974), and Nordvik ran the first exit test of its staff assistant on 2029-02-27 (RST-NR-2029-001): elapsed time within the objective, a quality gate missed at 0.87 against 0.90.

Months 7 to 9: March to May 2029

March: charters, a seeded fault and a clock that ran out

March was the month of paper that holds weight. On 2029-03-01 the Nordvik charter took effect, and at Hansa the second quarterly dark day, DKD-HM-2029-Q1, ran under the same scope rule; the escalation that had taken 14 minutes against a target of 10 in December took 9. On 2029-03-06 Nordvik adopted the review of the anti-pattern records (AIDR-0935), chaired by Maja Lindqvist with an outside reader from internal audit and Oskar Berg holding the stop of any exercise; on 2029-03-13 Hansa did the same for its five records (AIDR-0985), each with a re-test date inside the next quarter. On 2029-03-20 the SamDrift annex was signed.

On 2029-03-19 Nordvik ran the first quarterly seeded fault that AIDR-0910 had promised for the first quarter, written by Joakim Wester with the agreement of the unions that results measure services and never persons. The seed was an authorised, scoped fault in name resolution that the Region's own probe should detect, with the duty manager holding the stop. The observer's target of two consecutive failures at a 60-second interval is a design value, and the measurement was the first real one: 2 minutes 41 seconds against a target of 2 minutes, because the interval and the retry did not line up as designed. The observer principle asks for measurement and not belief, and the measurement was a small miss that the annex's machine-readable feed would not have fixed. Maja Lindqvist changed the probe's schedule and entered a re-test for 2029-04-30.

The calendar also caught a risk acceptance. In DRF-NR-001 Henrik Dahl had accepted that the duty manager could attempt a portal failover with the platform lead's concurrence while the claim stood failed, expiring on 2029-03-31 or at the first passing re-test. No re-test had passed, and on 2029-03-28 he renewed the acceptance to 2029-06-30 on condition that a re-test ran before the end of April. An expiry that forces a person to decide again is the intended behaviour of an expiry.

On 2029-03-27 Hansa recorded its on-call charter ONC-HM-2029-01 (AIDR-0975) after review of the first quarter. The rota of 12 trained incident commanders across Hamburg and the Polish service centre has a five-minute acknowledgement target for a Tier 1 page, so the working-time question is live: in Matzak the Court of Justice held that stand-by at home with an obligation to respond within eight minutes was working time, because the constraints very significantly restricted the worker's other activities (19, CJEU, 2018), and counsel confirms the application in each member state. The charter caps pages per shift at 20 with a floor of one half actionable, reviews them monthly with Tobias Richter and in aggregate with the Konzernbetriebsrat, and carries agent clauses: the agent's actions are attributed to its delegation profile and owner, a stop is never counted against the person who exercised it, and a limit applies to the supervised classes that one agent operator holds at once. On 2029-03-31 both reports of the first year were due; Chapter 30 gives their content.

April: a failover that failed again and an outage

On 2029-04-10 Nordvik Region ran the first re-test of the portal failover, RST-NR-2029-002, with SamDrift's participation under the annex. The two causes of the 2027 failure had been repaired: the time-to-live of the relevant record was now short and the certificate at the recovery site was renewed and monitored. The test failed again, by a new cause. The manual edit of a name-service record had to pass through a normal-priority change queue at SamDrift, where it waited 31 minutes, and the measured time was 2 hours 25 minutes against 2 hours. The Region recorded the result as failed, as the register requires, and not as passed with observations. Joakim Wester's runbook gained a step that names the SamDrift contact and the priority that the annex now provides, and PRB-NR-0007, the problem record of the 2027 storage controller failure, stayed open because it closes only when a failover of the portal meets its objective. The re-test of the staff assistant's exit test, due on 2029-04-24 (RST-NR-2029-001), passed with a quality score of 0.91. The seeded-fault re-test of 2029-04-30 measured 2 minutes 4 seconds against 2 minutes and was accepted, because the target is two failures at a 60-second interval and the extra seconds are the interval itself.

On 2029-04-11 Hansa Mutual's observability vendor, Lumenscope, had an outage: its ingestion path was degraded from 10:12 to 12:02, 1 hour 50 minutes. The group was not blind on the claims core or the triage service, because OBS-HM-0001 runs two scripted synthetic probes from Cloud B and the Polish service-centre network and its heartbeat receiver sits outside the vendor. HM-OPS-001 kept restarting inside its mandate, each action confirmed by the independent probe, and the status feed was recorded as telemetry beside the time of the group's own first failure. The group was blind on the services that the manifest does not cover: the payment gateway and the customer portal had no independent probe, and Katarzyna Zielińska's service desk was for 40 minutes the only observer of the portal. The incident, INC-HM-2029-0214, was a smaller version of INC-HM-2027-0572, in which 14 services were unobserved for 3 hours 10 minutes: the manifest is deliberately small and its coverage is a claim with a boundary. Tobias Richter extended it to the payment services as OBS-HM-0002, and the register of information under DORA, which lists Lumenscope as supporting critical or important functions, carried the incident into exit planning for the vendor (2, European Union, 2022). It was the first time that the heartbeat did what a dead-man's switch is for: an alert whose silence at an external receiver means the pipeline has stopped (263, Prometheus Operator, n.d.).

May: an expiry

On 2029-05-07 the break-glass result expired by clock, and AP-NR-OPS-01 came due. Maja Lindqvist and Oskar Berg repeated the test with federation disabled: two named people reached the management plane in 8 minutes, and the result was valid for a further 90 days. Nothing had changed in the management plane in the interval, which is the condition under which a result ages without being invalidated. Since 2029-04-01 Joakim Wester had been mentoring the first occupant of the standby secondary seat on the out-of-hours rota, which is the apprenticeship rotation of PLAN-NR-OPS-2029-01, and in May the first monthly tabletops of the incident and problem forum ran on INC-NR-2028-0391. The result of the tabletop was a change to the case-management migration runbook: the schema migration now has a precondition that a restore into a separate target has been timed within the objective in the previous 30 days.

Months 10 to 12: June to August 2029

June: two re-tests pass

On 2029-06-05 Nordvik Region ran the second re-test of the portal failover, RST-NR-2029-003, with SamDrift's change queue on the priority lane. Measured recovery time was 1 hour 41 minutes against 2 hours and the recovery point was inside its 5 minutes. The probe that verified it was Sara Ekdahl's service desk sample together with the Region's external probe, and it was not the platform team's tooling. The claim SVC-NR-002 / failover to the recovery site became verified from 2029-06-05 until 2029-12-02, which is 180 days. The risk acceptance of DRF-NR-001 ended at the pass, and the problem record PRB-NR-0007 closed with it. The failover had taken from 2027-10-12 to 2029-06-05 to move from failed to verified, about 20 months, with one more failure on the way. That interval is the book's argument about closure: an action closes when its re-test passes and not when the change is made.

On 2029-06-12 Hansa Mutual ran the game day with the agents off that Chapter 26 said the register needed: the restore of the claims core database from the immutable backup into Cloud B, RST-HM-2029-001, the claim that RST-HM-2027-004 had failed on time. Scenario and runbook (RBK-HM-0014) were the same; the agents were switched off at the stop path, and restore-overwrite, which no agent holds, was what people had to do. It was placed in working time under the operations annex, on a day-shift week for Ewa Kowalczyk, who commanded the exercise, and the runners were site reliability engineers who had not written the runbook. Measured recovery time was 3 hours 41 minutes against 4 hours and the recovery point 10 minutes against 15. The probe was independent of the runner's tooling and credentials, and the head of operational resilience attested the record. The claim became verified until 2029-12-09. How the earlier tests count under Article 11(6)(a) of DORA, which requires the recovery plans to be tested at least yearly and after substantive changes to systems supporting critical or important functions, is for counsel and the head of operational resilience to record (2, European Union, 2022). The payments failover of RST-HM-2027-007 had expired on 2028-04-02 and had not been re-run by the end of the year.

July and August: reviews and what was not done

On 2029-07-23 Nordvik Region reviewed AIDR-0921 on its schedule and kept the form: the median, the 90th percentile and the list beyond the objective. Hansa's reviews of the autonomy budget for the second and third windows crossed no threshold. Neither organisation raised a level during the year: HM-OPS-002 stayed at Level 1 Assisted, rollback at Level 2 Supervised, failover at Level 1 and NR-OPS-001 at Level 0 Advisory, because the sampled accuracy of its summaries had not been measured over two quarters. The Konzernbetriebsrat's question whether the rota and conductor roles would merge remained a trend to watch, which Chapter 27 labels speculation. The year ended without anyone claiming that it was finished.

What the year showed

The first lesson is that the honest numbers were lower than the first dashboards, as they were in AI Purple's year. Nordvik's mean time to restore was green in a quarter with a 7-hour outage. Hansa's agent had 1,184 successes by its own count and 13 faulty actions by the probe's. The first measurement of Nordvik's observer missed its target, and Hansa's observer, deliberately small, left two Tier 1 services unobserved while Lumenscope's ingestion was degraded. In each case the instrument that was independent of the actor reported something worse than the actor, and in each case the organisation was better off for having built it. This is the book's fourth thesis, observed in a small sample: a loop closed by machines alone can hide its own failure, and what verifies must be independent of what acts.

The second lesson is that closure took longer than any plan. The portal failover failed in October 2027, failed again in April 2029 for a new reason and passed in June 2029. The claims restore failed in June 2027 and passed in June 2029. Each pass followed an action that the tracker had once shown as done, and the closure rule of Chapter 12, that an action is open until its re-test passes, is why the register could say anything in August 2029. It said less than anyone hoped: one verified claim for each organisation in this extract, each with a date, and a list of claims that were not.

The third is that autonomy did not move, and that this was a result. In a year of seeded faults, a game day, a near miss and a mandate revision the evidence that would justify a raise was assembled for the first time, and no level rose because the verified claims, seeded-fault results and drills were not all inside their conditions at once. Nordvik's answer was to build the observer, remove the god credential and write the manual form of its runbooks first. The levels are the same at the end as at the start, and the apparatus around them is not.

The fourth is about people. The same few named people handled the year's events in each organisation, which is a feature of a small operations team and a risk: Joakim Wester ran the restore of 2028-11-21, wrote the seeded fault of 2029-03-19 and mentored the standby seat. At Hansa the night window's agent operator was also its incident commander, which the charter's limit on concurrent supervised classes acknowledges. In both, the measures were reported for teams and services and the agreements held: no result was reported by name.

Three statements look beyond the year and carry the labels. It is observable that both organisations ended with more verified evidence than they began with and with the same levels of delegation. It is expected that the claims verified in June 2029 will expire in December unless the re-tests are scheduled, because the clock and the register compute expiry and do not wait for attention. Whether Hansa's night window will merge the roles of rota and conductor is speculation, and the Konzernbetriebsrat's request to see the trend is the right instrument for watching it. The author's own projections are kept to Chapters 27 and 31.

Worked example: a year ledger

The ledger below is an illustrative extract of the register that each organisation keeps. It is a record of events and claims, each with a date, a measurement and a state, in the form that Chapter 19 gives restore claims, and it is derived from the records of this chapter and of earlier chapters. It lists only what supports the narrative: three claims of Nordvik Region and two of Hansa Mutual, with the delegation levels in force at the end of month 12.

year_ledger:                       # illustrative; month 1 = 2028-09
  period: {from: 2028-09-01, to: 2029-08-31}
  nordvik_region:
    claims:
      - {service: SVC-NR-003, claim: restore-from-immutable-store, evidence: INC-NR-2028-0391,
         measured: "7 h 05 min against 4 h", date: 2028-11-21, state: failed_in_operation}
      - {service: SVC-NR-002, claim: failover-to-recovery-site, history: [RST-NR-2027-002, RST-NR-2029-002],
         evidence: RST-NR-2029-003, measured: "1 h 41 min against 2 h", date: 2029-06-05,
         expires: 2029-12-02, state: verified}
      - {service: OBS-NR-0001, claim: probe-detects-name-resolution-fault, evidence: SDF-NR-2029-001,
         measured: "2 min 04 s against 2 min", date: 2029-04-30, state: verified}
    delegation_end_of_year: {NR-OPS-001: "Level 0 Advisory", NR-OPS-002: "Level 1 Assisted",
                             NR-OPS-003: "Level 2 Supervised", scripted_runbook_above_level_2: none}
  hansa_mutual:
    claims:
      - {service: SVC-HM-001, claim: restore-from-immutable-backup, history: [RST-HM-2027-004],
         evidence: RST-HM-2029-001, measured: "3 h 41 min against 4 h; recovery point 10 min against 15",
         date: 2029-06-12, expires: 2029-12-09, state: verified, run_with_agents: off}
      - {service: SVC-HM-004, claim: failover-frankfurt-to-cloud-a, evidence: RST-HM-2027-007,
         date: 2027-10-05, expired: 2028-04-02, state: expired}
    autonomy_budget:
      first_review: {class: restart, executed: 1184, confirmed: 1171, faulty: 13,
                     consumption: "73 % of allowance", outcome: level_kept, counted_by: OBS-HM-0001}
    delegation_end_of_year: {restart: "Level 3 Bounded", certificate_renew: "Level 3 Bounded",
                             roll_back: "Level 2 Supervised", fail_over: "Level 1 Assisted",
                             restore_overwrite: "no agent; Level 1 by a named person"}

Practical guide: a monthly review of the operations loop

Purpose. Give the head of operations a one-hour monthly review that turns the loop's records into decisions, so that a year such as this one is made of reviews and not of surprises.

Roles. The head of operations or SRE lead chairs. The service owners of Tier 1 services, the agent owner, an agent operator, the head of operational resilience or the CISO's deputy as independent reader, and an employee representative where the works agreement provides for it attend. The observer's owner presents the figures.

Steps.

1. Read the register first. List each claim by expiry date and state, schedule every claim that expires within 60 days, and report failed, expired and not-tested claims beside the verified ones.

Defaults. Hold the review monthly, with the quarterly additions of a dark day, a seeded fault and a stop drill. Adapt the thresholds (the 70 per cent review level, the 60-day look-ahead, the 90-day drill currency) to the contract, to the works agreement and to the organisation's risk appetite.

Definition of done. Every claim on the register has a state and a date, every decision has an owner and a re-test date, no figure is reported by named person, and the minutes record who held the stop during any exercise.

Across the degrees of delegation

The table shows the delegation in force for the main classes at the start and at the end of the year. Nothing moved, and the evidence behind each level changed.

Agent and class	Level in month 1	Level in month 12	What held it or tested it in the year
HM-OPS-001, restart	Level 3 Bounded	Level 3 Bounded	Game day of 2028-10-24 found a self-verifying clause; OBS-HM-0001 made the independent probe the condition; budget review at 73 per cent kept the level
HM-OPS-001, certificate renewal	Level 3 Bounded	Level 3 Bounded	Runbook RBK-HM-0012; dark day exercised the manual form
HM-OPS-001, roll back	Level 2 Supervised	Level 2 Supervised	Candidate for Level 3 only after two quarters of evidence; held by AIDR-0960 and AIDR-0977
HM-OPS-001, fail over	Level 1 Assisted	Level 1 Assisted	Cross-provider evidence expired; held by the rule that no level rises without a verified claim
HM-OPS-001, restore-overwrite	Not delegated	Not delegated	Refused by the policy point in INC-HM-2029-0031; done by people in RST-HM-2029-001
HM-OPS-002, incident assistant	Level 1 Assisted	Level 1 Assisted	Replay of 60 incidents; second-hypothesis rule in INC-HM-2028-0871
NR-OPS-001, operations assistant	Level 0 Advisory	Level 0 Advisory	Shadow period; drafted the timeline of INC-NR-2028-0163 as a draft
NR-OPS-003, runbook runner	Level 2 Supervised	Level 2 Supervised	Three portal runbooks; no scripted runbook above Level 2 under AIDR-0910
Stop path, both organisations	Held by named people	Held by named people	Hansa's drill 17 min, then 4 min 10 s, then 3 min 55 s; Nordvik's holders at the gateway and in the break-glass test

Nordvik Region and Hansa Mutual

The year shows two organisations answering the same September question from different strengths. Nordvik Region has seven platform engineers who carry site reliability practice, a sovereign regional cloud and one national provider for the recovery site, DNS and paging. It spent the year on foundations: a credential audit, an observer that did not exist, an agreement with its unions, a failover that took two attempts and a restore that went badly in operation. It ended with a verified portal failover that it had been unable to claim for 20 months.

Hansa Mutual has a Mode 5 agent in production, a site reliability function of about 95, a 24-hour rota across two countries and a works council with co-determination rights. It spent the year on the agent: a game day that found it verifying itself, a budget review, a near miss that exposed an allow rule checking what the agent may do and not what prompted it, and a dark day and a restore with the agents off. It ended with one verified restore claim, one expired failover and no level raised.

Both ended the year able to say less than they had hoped and more than they could in September. Chapter 30 gives the conclusions for each.

Summary

This chapter followed Nordvik Region and Hansa Mutual from September 2028 to August 2029 and concerned all five operations functions. O1 Observe was the year's first build at Nordvik, where OBS-NR-0001 came into force and its first seeded-fault measurement missed the target by 41 seconds, and at Hansa, where a vendor outage left the claims services observed and two Tier 1 services not. O2 Diagnose was the assistants' gate and first use: a retrieval that helped, a ranking that was wrong and a rule that caught it. O3 Change was the provider change that altered a ranking, the migration that locked a database, the mandate revision after a refused restore and the removal of standing credentials. O4 Restore carried the weight: a game day that caught an agent verifying itself, a restore of 7 hours 5 minutes against 4, a failover that failed again and then passed, and a claims restore that passed with the agents off. O5 Sustain was the learning: closure by re-test, the first budget review and the on-call agreements.

The honest numbers were lower than the first dashboards, closure took longer than any plan, and no level of delegation rose, which was a result and not a failure. The evidence that would justify a raise was assembled for the first time, and a verified claim, a seeded-fault result and a drill inside its target were not satisfied together. In every case the independent observer reported something worse than the actor, and each organisation was better off for it. Everything in the year is fictional and illustrative; the instruments and studies cited are real.

Chapter 30 returns to the report of 2029-03-31 and draws the book's conclusions for each organisation as a twelve-month plan from 2029-04-01, with decisions for the board, indicators of the book's own claims and the risks that remain. The results of April to August 2029 told here are the first months of that plan, seen in hindsight.

Sources

1. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (1, European Union, 2024)
2. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (2, European Union, 2022)
3. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (3, European Union, 2022)
4. European Parliament and Council of the European Union. Regulation (EU) 2016/679 (General Data Protection Regulation). (6, European Union, 2016)
5. Nordqvist, G. (2026). AI Governance. (296, Nordqvist, 2026)
6. Nordqvist, G. (2026). AI Red Team. (298, Nordqvist, 2026)
7. Nordqvist, G. (2026). AI Purple. (304, Nordqvist, 2026)
8. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6), 775-779. (217, Bainbridge, 1983)
9. Alvidrez, M. (2017). Embracing Risk. In: Site Reliability Engineering. O'Reilly Media. (258, Alvidrez, 2017)
10. Casner, S. M., Geven, R. W., Recker, M. P. & Schooler, J. W. (2014). The Retention of Manual Flying Skills in the Automated Cockpit. Human Factors 56(8). (233, Casner et al., 2014)
11. Court of Justice of the European Union (2018). Judgment in Case C-518/15, Ville de Nivelles v Rudy Matzak. (19, CJEU, 2018)
12. Kim, E., Garg, A., Peng, K. & Garg, N. (2025). Correlated Errors in Large Language Models. (103, Kim et al., 2025)
13. Prometheus Operator. Watchdog. kube-prometheus runbooks. (263, Prometheus Operator, n.d.)