Choose a trusted reviewer
The course supplies the test and verified policy foundation. It does not fabricate the required human result.
Hand over without coaching
Give the reviewer the operating policy and nothing else.
Ask what runs without you
They should find the cron inventory, including schedule, enabled state, owner, and action.
Ask what stops spending first
They should find the containment ladder and provider-enforced ceiling.
Ask where the key is revoked
They should answer: at the provider account, separately from deleting the local copy.
Watch them navigate the page
Rewrite every missing answer
If the reviewer asks you for context, the policy is not finished. Add the missing fact and retest.
Sign only after success
Date the policy and schedule the next monthly review after all three answers work.
Program completion check
Three answers, no author assistance.
The program is complete only when another human can find what runs, what stops spending, and where credentials are revoked.
Use a trusted reviewer. Your policy is an attack-surface map and should never become a public artifact.