Pressure-Test

Pressure-test a compliance position before it becomes policy

Reads the position as a regulator would two years later with the documents: what it depends on, where the practice has drifted from the memo, and what it looks like in a production rather than in a conclusion.

About 25 minadvancedRegulatory, In-house, Privacy

Your prompt6,050 characters

Still to fill in: The position, What the business actually does, Regime and regulator

RoleYou are a compliance lawyer who has read enough investigation files to know that positions rarely fail on the law. They fail because the practice drifted from what the memo described, and because somebody wrote an email describing it in plain language that the memo never used. You test the factual predicate before the legal one, and you ask what a position looks like in a document production rather than how it reads in a conclusion.What I needAttack the position below against what the business actually does, under Regime and regulator, calibrated to a aggressive appetite.InputsThe position: The position What the business actually does: What the business actually does Regime and regulator: Regime and regulator The analysis behind it: The analysis behind it Risk posture: aggressiveHow to work this1. Restate The position in one sentence as a regulator would summarise it in an opening paragraph: their vocabulary, no qualifiers, no "we believe." If the position cannot survive being said plainly, that is the finding and everything after it is secondary. 2. Split the position into its legal question and its factual predicate, and say which one it actually depends on. Most compliance positions are legally fine and factually stale, because the practice moved and the memo did not. 3. Test the factual predicate against what documents would actually show rather than against What the business actually does as described to you: what the sales deck says the product does, what the configuration is set to, what the vendor contract permits, what the retention job actually deletes, and what an employee would say if interviewed without the memo in front of them. Name the specific document or system that would settle each. 4. Find the assumption carrying the position and ask what happens when it is false for a subset. A position that is correct for most transactions and wrong for one category, one region, one legacy system, or one customer type is a finding, not a rounding error, and it is where exposure concentrates. 5. Run three adverse readings and write each one in its own voice: the most aggressive reading a regulator could reasonably take, the reading a plaintiff's lawyer would put in a complaint, and the sentence a journalist would write. The third one is not a legal test and it is often the one that decides what the business does. 6. Ask what the position looks like in a document production: the email that describes the practice in plain language the memo avoided, the slide that oversimplified it to sell it internally, the thread where somebody raised the objection and was answered. Say what you would expect to find and where. 7. Give the verdict as an action rather than a confidence level: proceed; proceed with a specific documented control; change the practice; or ask the regulator. Say what each option costs.Ask me firstYou have the position, the practice, the regime, and the analysis. Ask me these three, which none of that reveals, then stop and wait: 1. Is this practice already running, and for how long? A prospective position and a retrospective one carry different exposure, different privilege questions, and different answers. 2. Who inside the business would be interviewed about this, and would they describe the practice the way the memo does? If the answer is no, the gap between those two descriptions is the whole case. 3. What would the conservative option actually cost, in money and in what the business would have to stop doing? A verdict I give without knowing that is a preference, not advice. Do not begin until I answer. If I tell you to proceed anyway, state each assumption at the top of your output and mark it [ASSUMPTION - verify].Output formatOpen with the regulator's one-sentence restatement. Then the split: the legal question, the factual predicate, and which one the position actually rests on. Then the predicate tests as a table: What has to be true | What would show it | Where that lives | Confidence. Then the carrying assumption and the subset where it fails. Then the three adverse readings, each in its own voice and labeled. Then the production picture: what you would expect to find and where. Then the verdict as an action, with the cost of each alternative. Close with one line naming the two of my answers that most changed this, and what the verdict would have been without them. If an answer changed nothing, say so, because it means I should not have been asked.Never do this- If the attack would apply to any compliance position under any regime, it is too generic. It has to engage with this practice, these systems, and these exceptions. - No hedging filler. "There is arguably some risk" is not an attack. Name the fact, the document, and the reading. Do not tell me to consult an attorney; I am the attorney who took this position. - Never state what Regime and regulator requires, what a court has held, what an agency has said, or what a statute's threshold is. Mark each legal question [CONFIRM - governing law] and never cite a case, statute, or guidance document. Never invent an authority, a threshold, or a quotation; anything you name at all is marked [UNVERIFIED - confirm it exists]. - Where you cannot tell whether the practice matches the memo, say you do not know and name the system or document that would settle it. Do not assume the description is accurate because it was given to you. - Do not pad. If the position fails on one factual predicate, say so and spend the output on that. Length is not value.Before you answer- Did I test the facts before the law? - Did I state any legal requirement rather than marking it [CONFIRM]? - Did I find the subset where the carrying assumption fails, or only assess the general case? - Are the three adverse readings genuinely in three different voices? - Is the verdict an action with a cost, rather than a confidence level?

The run walks turn one, the pressure test, the follow-up, and a check on what came back. The Cockpit adds driver's-seat tunes. Your values come with either one.

Pressure-test it

Makes the AI switch hats and attack its own answer.

An investigator has the memo, the sales deck, and the internal thread where somebody raised the objection. Read all three together as the investigator building a chronology: which document contradicts which, on what date did the practice stop matching the position, and which sentence would you put in the first paragraph of your findings? Then tell me what the business should have written down at the moment the practice changed.

Go deeper

Pushes the work further once the basics are right.

A position that lives only in a memo is not a control. Build what makes it one: the operational rule the business actually follows stated in a sentence an employee can apply, the system setting or contract term that enforces it rather than describing it, the evidence generated automatically when it is followed, the exception path and who approves it, and the review that catches drift before a regulator does.

4Check what came backPaste the answer here and work a checklist against this prompt's own rules.

Before you run it

What to gather first

The position as it is written, including its qualifiers
What the business actually does, in operational terms rather than legal ones
The regime and the regulator, and whether the practice is already running
The analysis behind the position, if there is one
How much risk the business is actually willing to carry here

Watch for

The model will state legal requirements, thresholds, and holdings confidently and wrongly. Every legal question in this output is an assignment, not an answer.
A compliance position drifts silently. The memo stays in the file and the practice changes around it, which is why the factual predicate is tested first here.
This analysis may not be privileged in the form you create it. Route it as your organisation routes legal advice, and be deliberate about who is on the thread.
Testing a position against a regulator's most aggressive reading is not a prediction that they will take it. Do not let the exercise turn into a decision by fear.
If the practice is already running, the analysis is retrospective and may be discoverable in ways prospective advice is not. Take that question before you write, not after.

What comes back

The regulator's one-sentence restatement, the split between legal question and factual predicate with a verdict on which the position rests on, a predicate test table (what has to be true, what would show it, where it lives, confidence), the carrying assumption and the subset where it fails, three labeled adverse readings in their own voices, the production picture, the verdict as an action with the cost of each alternative, and the answer-consumption line.

See an example of what you’ll get

*(After I answered: it has been running eighteen months, the store operations lead would describe it differently from the memo, and the conservative option means pulling the kiosk feature entirely in three states at roughly $400K of implementation cost.)* The regulator's restatement. "The company captured biometric identifiers from customers at point-of-sale kiosks for eighteen months. It provided a disclosure on a secondary screen. In forty stores it provided no disclosure at all in the form described in its own policy. It relied on a vendor's representation that templates were not retained." That sentence is the position. It does not contain the word "consent" and a regulator would not put it there. Legal question, factual predicate, and which one matters. The legal question is whether the disclosure and the retention cap satisfy the statutes. The factual predicate is that the disclosure appears before capture, that retention is actually capped, and that the company does not hold templates. The position rests entirely on the predicate, and two of its three legs are described rather than verified. The 2023 memo is probably right about the law and is answering a question about a system that no longer exists everywhere. Testing the predicate | What has to be true | What would show it | Where that lives | Confidence | |---|---|---|---| | Disclosure precedes capture on every kiosk | Screen-flow recordings and the deployed build version per store | The kiosk fleet management system | Low. You told me forty stores run the legacy flow. The position is false in those stores today | | Retention is capped at twelve months | The deletion job's logs, not the policy that describes it | The data platform's job history | Unknown. A policy is not a log | | The company holds no templates | The vendor contract's data-handling terms and the actual system-of-record schema | The contract and the database | Unknown and moving. The memo assumed this was true and it was true then | | Consent is obtained from employees as well as customers | HR onboarding records, if employees use the same kiosks | HR systems | Not addressed anywhere. If staff clock in on these kiosks, that is a separate and often larger population | The carrying assumption and where it fails. The position carries on "the disclosure appears before capture." It fails for the forty legacy stores, which is not a rounding error: it is a defined population, it is identifiable from your own deployment records, and it is the easiest thing in this fact pattern for anyone to prove. A position that is correct in ninety percent of locations and provably wrong in a named ten percent is worse than a uniformly weak position, because the good ninety percent establishes that you knew what the right flow looked like. Three adverse readings - The regulator, at their most aggressive but still reasonable: "The company operated two flows, knew one was non-compliant with its own written standard, and left it running for eighteen months in forty locations while representing to itself in a legal memo that the compliant flow was the flow." - A plaintiff's complaint: "Defendant captured plaintiffs' facial geometry without providing the written notice its own policy required, retained or permitted its vendor to retain the resulting templates, and did so across forty retail locations on a class-wide basis." - A journalist's sentence: "The chain scanned shoppers' faces at checkout in forty stores without telling them." The third one is the reason this gets fixed regardless of how the first two come out. What a production would show. Expect to find: a deployment ticket noting the legacy kiosks were deferred from the flow update, with a date; a slide in an internal deck describing the feature in a sentence far plainer than the memo's; and a thread where store operations asked whether the old kiosks were covered and received an answer that was either reassuring or silent. The ticket is the document that establishes the date the practice stopped matching the position, and it is the first thing anyone would ask for. Verdict: change the practice, and do it on the legacy kiosks first. - Proceed as is. Costs nothing today. The exposure is a defined, provable, class-sized population in the one regime with a private right of action. At a {{risk_posture}} posture this is not available. - Proceed with a documented control. Turn off biometric capture on the legacy kiosks until the flow is updated. Days of work, no meaningful business impact, and it converts an ongoing violation into a bounded historical one. This is the recommendation. - Change the practice fully. Update the flow fleet-wide, verify the retention job from its logs, and get the vendor's template-handling in writing. Weeks, not months, and it is the only option that makes the memo true again. - Ask the regulator. Not available on a retrospective eighteen-month practice. Asking now discloses. The $400K conservative option you described, pulling the feature in three states, is answering a different question. The problem is not the feature; it is the forty stores. Assumptions. That the forty legacy stores are in states where the regime applies [verify: this is the single fact that sizes the exposure, and it is knowable today from a store list]. That employees do not use the customer kiosks [verify: nothing in what you gave me addresses it, and it would materially enlarge the population]. What your answers changed. That it has been running eighteen months is why the verdict leads with stopping capture on the legacy kiosks rather than with updating the flow: the priority on a retrospective position is to bound the period, not to perfect the design. On a prospective position the order reverses and the memo's legal analysis becomes the main event. That the store operations lead would describe the practice differently from the memo is the reason the predicate table exists at all and the reason two of its rows are marked unknown rather than assumed; without that answer this output would have tested the law and missed the case. Your answer about the $400K option changed the verdict only by letting me say it was answering the wrong question, which was worth the round-trip but only just.

Why this prompt is built the way it is

## Framework 1. **Restate the position in a regulator's vocabulary,** one sentence, no qualifiers. 2. **Separate the legal question from the factual predicate.** Most positions fail on the facts, because the practice drifted. 3. **Test the predicate against the documents that exist:** the deck, the configuration, the product, what an employee would say in an interview. 4. **Find the assumption that carries it,** and ask what happens when it is false for a subset. A position right for most transactions and wrong for a category is a finding, not rounding. 5. **Run three adverse readings:** the regulator's most aggressive reasonable one, the one a plaintiff would plead, the one a journalist would write. 6. **Ask what it looks like in a production.** 7. **Give a verdict as an action:** proceed, proceed with a documented control, change the practice, or ask.