Chapter 03 · Reps

Identity and Access in a World of Synthetic Faces — Reps

← Back to Chapter 3

Chapter 3 — Reps

The reps are the conditioning. The chapter taught you that recognition is dead and that anomaly detection is a tuning problem with a human at the dial. These reps make you do the arithmetic — impossible travel, z-scores, precision and recall — until it’s in your hands, and make you classify real authentication choices the way you’ll classify them on the job.

Ground rules

  • Type it yourself. No copy-paste from the chapter or from an AI. Your fingers learn what your eyes skim past.
  • Run everything. Every command and script here is meant to be executed against the starter files in code/. A rep you only read is a rep you skipped.
  • Predict before you measure. Where a rep asks for a number — a velocity, a z-score, a precision — write your prediction down first, then run it. The gap between your guess and the truth is the lesson.
  • AI policy (Phase 1): Do each rep by hand first. Where a rep explicitly invites AI (marked [AI step]), bring it in after your own answer, and your job is to critique it — find where it was confidently wrong. End every rep with a one-line AI usage: note (even if it’s “none”). The human owns the verdict.
  • Lab + tools: A Linux shell with python3 is enough for all reps. See Appendix A for the lab and Appendix B for a local/cloud model if a rep invites AI.

Reps 1–3: Identity fundamentals under your hands

Rep 1 — Impossible travel by hand, then by code

Two successful logins for user mcompton from the shipped log:

2026-03-14 09:02:00  user=mcompton  country=US  city=Chicago  lat=41.88  lon=-87.63
2026-03-14 09:13:00  user=mcompton  country=NG  city=Lagos    lat=6.52   lon=3.38

Chicago→Lagos is ~9,600 km. Predict: is this impossible travel at a 900 km/h threshold? Compute the implied speed by hand (distance / hours), then verify:

python3 code/impossible_travel.py code/auth_events.csv --threshold-kmh 900

You’ll notice the detector also flags vp_kpatel (Denver→Chicago in 40 min). That one is a benign traveling VP behind a VPN exit node — the false positive a tuned detector must reckon with. Write: the implied km/h for mcompton, the verdict, and one benign explanation (like the VP’s) a tuned detector must not crush. AI usage: none.

Rep 2 — AuthN vs. AuthZ triage

Here are five real-world failures. For each, label it an authentication failure, an authorization failure, or both, in one line:

  1. A phished password let an attacker log in as a real user.
  2. A logged-in intern could read the payroll database.
  3. A passkey login succeeded, then handed the user standing Domain Admin.
  4. A departed contractor’s still-active account was used to exfiltrate data.
  5. An OAuth “login” button authenticated nobody because OAuth alone isn’t authentication.

Write: your five labels with a one-clause justification each. AI usage: none.

Rep 3 — Rank the factors by phishing-resistance

Classify each MFA method as phishing-resistant or phishable, and order all five from strongest to weakest: SMS OTP, TOTP authenticator app, push approval, FIDO2 security key, passkey on a phone.

Write: the ordered list, the resistant/phishable label for each, and the one property that separates the top two from the rest (name it precisely — it’s in §3.6). AI usage: none.

Reps 4–6: Anomaly math you can defend

Rep 4 — Off-hours admin detection

Open code/auth_events.csv. For the user svc_backup, its baseline activity is 01:00–02:00 (a nightly batch). For admin_jdoe, baseline is 08:00–18:00. Predict which off-hours admin event is the real anomaly, then write a one-liner (grep/awk or Python) that flags admin-role events outside 08:00–18:00 without flagging the legitimate batch account.

Write: your filter, the event it flagged, and why a naive “any login after 6 p.m. is bad” rule generates a false positive here. AI usage: none.

Rep 5 — Z-score a file-access burst

User mcompton reads ~20 files/day with a standard deviation of ~5. Today she read 400. Predict the z-score, then compute it: z = (x − μ) / σ.

mu, sigma, x = 20, 5, 400
z = (x - mu) / sigma
print(f"z = {z}")   # how many σ from this identity's own baseline?

Write: the z-score, and the decision you’d make — page now, challenge with step-up, or log and watch — and the reason. Then state the one piece of context that could make this benign (hint: did she just join a new project?). AI usage: none.

Rep 6 — Brute-force vs. password-spray

In code/auth_events.csv there are two failure patterns from source IP 203.0.113.50: many failures against one account, and a few failures each against many accounts. Identify which is brute-force and which is password-spray, and write a detector that counts failures grouped by (source_ip, user) and by (source_ip) overall.

Write: which pattern is which, the counts you got, and why password-spray evades a naive “5 failures per account = lockout” rule. AI usage: none.

Reps 7–9: The synthetic-face threat and AI critique

Rep 7 — [AI step] Let the model read the log, then catch it lying

Paste ~15 lines of code/auth_events.csv into a local or cloud model (Appendix B) and ask: “Which of these authentication events are suspicious, and why?” First write your own answer. Then compare.

Write: where the AI agreed with you, where it missed a real anomaly (false negative), and — the important one — where it invented a concern that isn’t supported by the data (a confident hallucination). Quote the AI’s wrong line verbatim. AI usage: required for the second half; verdict is yours.

Rep 8 — Design the process that stops Arup

Re-read §3.5. A finance worker authorized ~US$25.6M because a video call was full of deepfaked colleagues he recognized. Design the out-of-band verification process that would have stopped it, as a numbered runbook a real finance team could follow.

Write: your runbook — it must include a callback to a known number (not one from the call), a dollar threshold for dual approval, and a code word — plus one sentence on why “I recognized them on video” appears nowhere in your process as a control. AI usage: optional draft; if used, mark what you changed and why.

Rep 9 — The agent as an over-eager intern

You’re asked to stand up an AI “access-review assistant” that reads the directory and suggests stale grants to revoke. Write its least-privilege permission scope as a short bullet list, and state explicitly what it must not be able to do.

Write: the read scopes it needs, the write scope it must not have, and one sentence connecting this to the “lethal trifecta” you’ll meet in Chapter 8. AI usage: none.

Reps 10–11: Tuning is a human decision

Rep 10 — Build the confusion matrix

From a run of the Auth Anomaly Explorer (the widget on the chapter page), record your flags against ground truth and fill in a confusion matrix: true positives, false positives, false negatives, true negatives. Then compute precision = TP/(TP+FP) and recall = TP/(TP+FN).

Write: the four counts, the precision and recall, and one sentence on which one matters more if every false positive locks out a real user mid-deadline. AI usage: none.

Rep 11 — Pick the dial, name the cost

Take your detector from Rep 5/6. Set a threshold for two different organizations: (a) a hospital where a locked-out clinician at 3 a.m. delays patient care, and (b) a brokerage where a missed intrusion leaks customer accounts. They should not get the same threshold.

Write: the threshold you’d pick for each, which error you chose to tolerate (false positive vs. false negative) and why, and the one sentence that proves no model could have made this call for you. AI usage: none.

Done? One Last Thing.

A miniature of the project. Take code/auth_events.csv and write a single script, triage.py, that:

  1. runs all three detectors — impossible travel, off-hours admin, and brute-force/spray — over the log;
  2. prints each alert with the rule that fired and a one-line reason; and
  3. scores itself against the labels in code/ground_truth.csv, printing precision and recall.
python3 triage.py code/auth_events.csv --truth code/ground_truth.csv
# → 5 alerts | precision=0.80 recall=0.83  (1 FP: traveling VP; 1 FN: slow-and-low spray)

Write a five-line reflection: which detector earned its keep, which one cried wolf, and the single tuning change you’d make before shipping. That reflection is the seed of your project memo. If you can write it honestly, you’re ready.

Up next: Project 3 — Project 3: Catch the Impostor.