Research question and scope: when a predefined risk condition appears, does work pause, preserve its state, and reach the authorized decision owner? Restrict the study to one lane and a written rule in effect for the whole observation period. Sample triggered cases plus similar cases where the rule did not trigger.
Methodology: retain the instruction version, observed condition, action taken, preserved evidence, notification time, receiving owner, decision, and restart record. Two reviewers should independently classify a subset. Treat disagreement as evidence about rule clarity, not automatically as contributor error.
NIST and CISA provide risk, response, and identity-access concepts, while GAO describes control responsibility. They do not validate a local stop rule, establish individual performance, or prove that one operating model is safer than another. Local owners must define consequence and authority.
Inference limits and limitations: rare events, hindsight, incomplete records, reviewer knowledge, and policy changes can bias the findings. The design cannot prove intent or prevented harm. Report excluded cases and disagreement, avoid personnel conclusions, and repeat the review after clarifying any ambiguous trigger.