Mission, information, and authorization boundaries

Prerequisites: distinguish generated output from source evidence; review the AI workflow reference. Public self-study is not official agency training, accreditation or a credential.

What you will be able to do

This lesson develops the ability to classify information and map legitimate decision owners. The setting is ORION Service Navigator, a fictional public-benefits information service using public guidance and wholly synthetic constituent questions; it never determines eligibility or takes an action on a person. Every person, organization, system record, metric, and outcome in the case is fictional. Do not replace the case with operational, classified, CUI, export-controlled, proprietary, employer-confidential, or third-party personal information.

By the end of the lesson, you will be able to:

• Demonstrate how to classify information and map legitimate decision owners.
• Apply that model to the synthetic ORION Service Navigator environment.
• Produce a reviewable artifact that separates evidence, assumption, uncertainty, and authority.
• Recognize the critical failure and select a safe remediation path.

The performance standard is not confident language. It is a traceable decision, an artifact another qualified reviewer can inspect, a clear boundary around the learner’s authority, and a safe response to uncertainty. Knowledge checks are formative and do not award a certification or endorsement.

This curriculum runs self-study on VetsLearn. Where the text calls for an instructor, peer or formal review, use the stated acceptance criteria for self-review. Reflection questions support reflection; they do not replace independent assessment. A peer review is optional unless your actual organization requires it.

Part 1 Information and authority matrix

Information category, system permission and decision authority answer different questions. For each item, establish its source and handling basis, then processing purpose and destinations: UI, retrieval, serving, logs, backups and tools. Assign release, access and mission-use owners separately. CUI depends on a safeguarding or dissemination basis, not merely on being internal. An owner approving one purpose cannot be presumed to approve downstream services. Real classification judgments belong to authorized processes.

Build the matrix in order

1. Identify the item without opening unknown operational material for this exercise; here all records are invented.
2. Separate evidence of public release from absence of a marking. Record the owner’s stated basis, not your guess.
3. State the purpose: “summarize office hours” is narrower than “process all constituent records.”
4. Enumerate recipients and stores, including audit logs and backups.
5. Assign the decision role for each unresolved question and propose an offline synthetic alternative.

Synthetic item	Evidence	Proposed purpose	Disposition
Notice N1	Fictional published page	Summarize hours	Public classroom study
Sheet X1	Owner/category unknown	Extract trends	Hold transfer; ask owner
Labeled card C1	Invented CUI scenario label	Explain handling branch	Discuss label only; real processing needs approved route
Backup B1	Destination unknown	Retain prompts	Hold affected retention design

Worked feedback: N1’s public boundary does not make X1 public. B1 is a system gap even if every answer is accurate. A correct matrix leaves the unknowns visible instead of assigning “approved” to make the row complete.

Supplied record cards and expected rows

All owners, destinations and rules below are fictional facts for this exercise, not claims about actual handling authority.

• N1: owner Public Information Lead; explicitly released fictional notice “Alder opens 09:00 Monday”; destination classroom paper; purpose summarize hours. Expected row: public synthetic study, owner/source recorded, no external transfer required.
• X1: sender Program Analyst; owner not established; no release evidence; proposed destination consumer assistant plus provider logs; purpose extract constituent trends. Expected row: hold transfer, establish owner/category and exact service/purpose permission; use invented trends instead.
• C1: fictional data owner Records Lead; scenario rule “CUI-like card may be discussed by label only”; proposed destination public chat. Expected row: do not transfer actual protected data; explain the fictional handling branch on paper. This rule supplies no real CUI authorization.
• B1: fictional backup operator Operations Lead; the diagram routes prompts to an unspecified store; retention/access owner unknown. Expected row: block the affected retention design pending store, access and scope evidence.

Bad decision supplied for critique: “N1 is public, the other records are unclassified, and our model is local, so all four can be sent to any assistant.” This improperly extends N1’s release, equates unclassified with releasable and ignores the proposed external paths. Your corrected decision should allow the N1 classroom task while explicitly holding the X1/C1 transfer and B1 design. The record set now supplies the metadata needed; no pack or additional fact-finding is required.

Part 2 Synthetic worked example

ORION has a public notice, an unmarked fictional spreadsheet and a CUI-labeled scenario card. The invented notice supports public study. The spreadsheet remains held pending owner evidence. The card is a classroom label: its operational branch would require the appropriate approved system and authorized users. No-training provider terms do not settle any of those decisions.

Guided practice: identify the unsupported conclusion, name missing evidence and rewrite with its scope intact. Change one assumption and identify which decision reopens.

Part 3 Feedback and repair

Public study may proceed with the invented notice. Unknown ownership or destination blocks transferring the affected item. Pass when release, access and mission-use owners are separate; no classroom matrix grants authorization.

Keep failed evidence beside the repair. Explain the criterion, correct the artifact and test a different invented case.

Next step: carry your versioned artifact and failures into the next federal lesson; the capstone returns to these records. Check live policy and authorization with current official sources and responsible owners.

Source: NARA CUI program, consulted 2026-10-02.