Building a Toolbox: Nordvik Region and Hansa Mutual
This chapter follows the two fictional organisations of the series as they build and run a toolbox over one year. The earlier chapters of this book treat the tools by activity, and a reader who has followed them has met every tool named here. What the earlier chapters could not show is order: which tool an organisation takes up first, what it leaves out on purpose, what it measures to know that the toolbox works, and what it retires. The chapter draws on the selection, adoption and retirement tools of Chapter 3, the anatomy and evidence-age rules of Chapter 2, and the Nordvik Region and Hansa Mutual subsections of Chapters 4 to 23.
The status of the facts matters, and the chapter keeps them apart. The profiles of the two organisations, the identifiers and the figures quoted from the examples of the earlier volumes are established (2, Nordqvist, 2026) (3, Nordqvist, 2026) (10, Nordqvist, 2026). The year itself, its four quarters and the order of adoption within them are illustrative: no earlier volume narrates a year of tool adoption at either organisation, and the chapter proposes an order that is consistent with what the volumes do record. Where the chapter states a measure that the volumes do not give, it says so. The chapter does not add tools, identifiers or numbers to the profiles.
The two starting points
The two organisations are chosen to differ in the ways that matter for tool choice (Chapter 1). Nordvik Region is a regional public authority with about 6,000 employees and about 450,000 residents, under one legal regime, which mostly procures its AI systems. It runs no autonomous production agent (no Mode 5), and its engineering capacity is small: a platform team of seven engineers who carry site reliability practice, a team of six on the security side, and a duty manager and platform lead who hold the stop path for its runbook runner (10, Nordqvist, 2026). Hansa Mutual is a multinational mutual insurance group with about 9,500 employees and seven legal regimes. It builds as well as buys, and it runs Mode 5 agents in several domains: a claims-triage agent, an IT-operations agent with write access to production, and agents in the security operations centre and in the purple loop (2, Nordqvist, 2026) (10, Nordqvist, 2026).
These starting points set the first decision. A toolbox is not built from a list of tools. Chapter 3 gives the series' order for any single tool: select against one unit of value, test readiness, pilot on a contained service, adopt with an adoption dashboard, review on a date, retire against stated criteria. At the level of the whole toolbox the same order asks one question before any other: which obligation or risk is already present and has no tool? For Nordvik Region it is the benefits-triage system, a high-risk system under Annex III point 5(a) of the AI Act of which the Region is deployer, whose decisions every caseworker makes and which residents may ask to see. For Hansa Mutual it is the agents that already act on production, which exist before any tool bounds them (2, Nordqvist, 2026). The year starts from these two different gaps, and the sequences differ because the gaps differ.
Figure 24.1: An illustrative adoption sequence at the two organisations. The quarters and the order within them are illustrative; the tools and identifiers are those the earlier chapters establish.
Nordvik Region: a year of a cautious buyer
Illustrative sequence. Nordvik Region's pattern in Chapter 3 is that of a cautious buyer whose largest risks are pilot purgatory, vendor-defined architecture and the model nobody retires, because retiring a procured system needs a new procurement (3, Nordqvist, 2026). Its first tools are therefore the ones that make what it already has legible.
Quarter 1: know and decide
The first tool is the AI system inventory entry of Chapter 7, because nothing else can be applied to a system the Region has not listed. The entries carry the usage mode, so that the Region's profile is visible at once: a Mode 4 benefits-triage system, a Mode 4 staff assistant, a Mode 4 citizen-service assistant, ambient AI at Modes 0 and 2 and no Mode 5 (2, Nordqvist, 2026). The risk-tiering questionnaire follows, applied once and against one regime. It classifies the benefits-triage system as high-risk and the staff assistant (AIDR-0211) as not, which sets which of the later tools apply to which system. Third in the quarter is the AI Decision Record of Chapter 7, with its retirement criteria. The Region already practises it: AIDR-0007 and AIDR-0011 record the triage system's design and human oversight, and AIDR-0018 records its retirement and replacement. Retirement belongs in the first quarter and not the last, because an entry without retirement criteria is the tool-level form of the model nobody retires (3, Nordqvist, 2026).
What the quarter leaves out is deliberate. There is no purple loop, no emulation, no chaos experiment and no delegation profile for an agent, because the Region has no agent for them to bound.
Quarter 2: map and gate
With systems listed and tiered, the Region maps obligations: the obligation register and the control mapping of Chapter 8, assured once and mapped to many. It adopts the policy engine in the way Chapter 3 shows as an illustrative worked example: a pilot on a contained service, the readiness scorecard rewritten for a policy engine, and an extension to a second and third team only when the adoption dashboard shows use and the exception rate is within a healthy range. The platform team that owns the protected paths is small, so the Region deliberately widens the engine one team at a time. The evidence pack of Chapter 5 (EP-2026-011 for the first internal audit of the triage system) is the product of the quarter: a gate that produces evidence the auditor can read (3, Nordqvist, 2026).
Quarter 3: buy and operate
Because Nordvik Region buys under public procurement law, the tools of Chapter 9 come before the tools of operating. The sovereignty requirements profile is attached to tender NR-2026-031, and the exit clause is priced as part of the option comparison, because switching suppliers is expensive and a weak exit clause becomes lock-in for years. The first exit test of its staff assistant missed its quality gate (2, Nordqvist, 2026); the Region treats that as a finding and not as a failure of the tool. In the same quarter the operating tools arrive in the order the volumes imply. A service record with its objective (SLO-NR-002 carries the collector fragment that minimises personal data) comes first. The seeded-fault test of its alerts follows, which AI Operations records both organisations needed before correlation could be evaluated against anything, and the restore-test record last, because a recoverability claim needs a test and a date (10, Nordqvist, 2026).
Quarter 4: delegate at Level 2
Only now does the Region write down delegation, and it writes down what cannot be enforced. The runbook runner NR-OPS-003 is a Mode 4 application under MND-NR-OPS-003 (AIDR-0916) with every executable class at Level 2 Supervised, and the decision-rights file DRF-NR-001 (AIDR-0922, illustrative) names the duty manager and platform lead as stop holders with the regional director as backstop. The threat register of Chapter 23 closes the year: nine entries, THR-NR-01 to THR-NR-09, owned by the chief information security officer and reported to the audit committee, which asked for the register in response to the council's motion (10, Nordqvist, 2026) (5, Nordqvist, 2026).
What the Region leaves out, and why
Nordvik Region leaves out the tools that presuppose something it does not have. It has no emulation agent and no Mode 5 agent, so it does not adopt a mandate for either, and its red teaming is bought: a contracted tester under call-off NR-2026-071 runs campaigns under RoE-NR-2027-001, and the plan EMU-NR-2027-02 states that no Mode 5 agent runs against Nordvik systems. It takes the evaluation and independence tools in a lighter form: a golden-dataset evaluation (EVAL-NR-SEC-001) for its SOC triage assistant, a quarterly seeded-error exercise, and independence written into the provider annex (MS-2-IND-1 and MS-2-IND-2) because it cannot instrument a provider's service itself (10, Nordqvist, 2026) (9, Nordqvist, 2026). Leaving a tool out is recorded, and the record names the condition under which it comes back: the Region would revisit emulation tooling if it gave an agent write access to production.
Hansa Mutual: a year of a builder
Illustrative sequence. Hansa Mutual's pattern is that of a builder with seven regimes. It runs the production readiness gate for its claims-triage assistant and carries the same golden path into further markets, where each market is a new readiness review (3, Nordqvist, 2026). Its first tools are the ones that bound what already acts.
Quarter 1: bound the agents
The first tool is the mandate manifest of Chapter 18, with its delegation profile. Hansa Mutual already has a Mode 5 IT-operations agent (decision record AIDR-0027), so waiting for the inventory to be complete before bounding the agent would leave a privileged workload unbounded. It adopts DLG-HM-OPS-001 (AIDR-0950) for the IT-operations agent, with Level 3 Bounded limited to the narrow reversible classes: restart, certificate renewal and scale. Configuration change stays at Level 2 and is authored for a named person to review. In parallel it adopts the inventory entry with the applies_in block, so that the same system is classified once for each of the seven regimes in which it operates. The exceptions it records, to principles (EXC-0004) and to funding criteria (EXC-2026-012), are expiring records from the first day (2, Nordqvist, 2026) (10, Nordqvist, 2026).
Quarter 2: observe and stop
A mandate that nothing verifies is a claim. The observer manifest OBS-HM-0001 covers the claims service, and the seeded fault SDF-HM-2028-002 showed that the agent's own verification missed a fault that an independent probe caught after 61 seconds. The stop drills belong to the same quarter. The first drill record, STOP-HM-ITOPS-2027-Q1-01, took 17 minutes against a target of 5; the later SPT-HM-ITOPS-2028-Q4-01 took 250 seconds against 300 (10, Nordqvist, 2026). The chapter does not place these two records in particular quarters of the illustrative year, because their identifiers belong to different years of the example. It uses them to show what a toolbox measures: a stop path is a tool whose output is a duration, and a duration against a target is evidence with an age.
Quarter 3: verify coverage
The coverage record, the regression case and the independence statement of Chapter 14 come third, because they need the observer and the mandate to exist. Hansa Mutual's continuous pipeline HM-SEC-004 runs benign S1 scenarios at Level 3 Bounded under MND-HM-EMU-01, with a stop-path target for the runner of 60 seconds against a generic default of 120. The independence statement IND-HM-2028-Q1 moved two cells of its purple loop to failed and left five verified with limited independence (9, Nordqvist, 2026) (10, Nordqvist, 2026). A toolbox that reports two failed cells where a dashboard once showed green is working as designed. The failed cells are the evidence that the tool measures something.
Quarter 4: weigh and sustain
The threat register comes last. Hansa Mutual keeps thirteen entries owned by the chief risk officer and challenged by the actuarial function, integrated with the group risk taxonomy. Its two speculative entries, THR-HM-09 and THR-HM-13, appear as reverse stress tests and are not priced (AIDR-0412). Its horizon registers tie each trigger to a number that already exists. The competence record of Chapter 21 and the on-call charter close the year, because by then an agent has acted for months and the question of who can still do the task without it has become real (6, Nordqvist, 2026) (5, Nordqvist, 2026).
What Hansa Mutual leaves out, and why
Hansa Mutual does not leave out whole families of tool, because it operates the activities they serve. What it defers is the consistency of a tool across markets. A national consultation is a different tool in each country (the commitments carry an applies_in scope), and the United Kingdom and Swiss entities use the readiness review with national rules in place of the AI Act rows (3, Nordqvist, 2026). It also leaves out the form of a tool that assumes public reading: its register entries do not need to be readable by residents and journalists, which Nordvik Region's must be. Its recurring exposure is of a different kind. Three Level 3 delegations in the security operations centre depend on one agent identity, and the toolbox contains the tool that shows it, the delegation register, but not yet the remedy (10, Nordqvist, 2026).
Compared
| Nordvik Region | Hansa Mutual | |
|---|---|---|
| First gap | A high-risk system with no inventory entry, tier or retirement criteria | Mode 5 agents acting on production with no mandate |
| First tools | Inventory entry, risk-tiering questionnaire, AI Decision Record | Mandate manifest, delegation profile, inventory entry with applies_in |
| Order of the year (illustrative) | Know and decide, map and gate, buy and operate, delegate at Level 2 | Bound the agents, observe and stop, verify coverage, weigh and sustain |
| Highest delegation | Level 2 Supervised; no Mode 5 | Level 3 Bounded in narrow reversible classes; Mode 5 in several domains |
| Testing | Bought: contracted tester, RoE-NR-2027-001 |
Held: group red team, RoE-HM-2027-TLPT, pipeline HM-SEC-004 |
| Independence | Written into the provider annex (MS-2-IND-1, MS-2-IND-2) |
Observer manifest OBS-HM-0001, independence statement IND-HM-2028-Q1 |
| Threat register | Nine entries, published under public-access rules | Thirteen entries, in the group risk taxonomy |
| Deliberately left out | Emulation and operations agents, continuous red teaming | Public readability of entries; a uniform tool across seven regimes |
| Main risk to the toolbox | Pilot purgatory and lock-in | Tool sprawl across markets; one identity behind several delegations |
The differences lie in who holds the tools and what they must prove, not in the discipline. Both sign a manifest before anything runs, both write records that expire, and both keep the stop path outside the executor (Chapter 11, Chapter 19).
What each measures
A toolbox that is adopted and not measured is shelfware, which Chapter 3 names as the first of the readiness anti-patterns. The series does not provide one artefact that measures a toolbox. It provides instruments for the parts, and this section assembles them into three measures. The assembly is this chapter's own conclusion, and the thresholds are illustrative unless a number is cited.
Evidence age
The first measure is how old the evidence is for each tool in use. The series' rule is that a claim of recoverability, coverage or competence has a date and an expiry (Chapter 2), and its clearest numbers are those that the volumes establish. A restore or failover test of a Tier 1 service ages out after 180 days or on a substantive change, whichever is first (10, Nordqvist, 2026). The delegation profile carries a review interval of 90 days, the mandate carries review_by and expires, and the exception for supplier key rotation (EXC-NR-0007) expires after 90 days. A toolbox review lists each tool with the date of its last test and the clock that governs it, and a tool past its clock is shown as unverified. The measure is the share of tools in use whose evidence is within its clock. Nordvik Region has a worked warning in its own records: AP-NR-OPS-03 shows a recoverability claim reported as met although its last test failed and its corrective actions were closed without a re-test (10, Nordqvist, 2026). Counting the date and not the claim is what prevents it.
Adoption
The second measure is whether a tool is used by those for whom it was chosen. The adoption dashboard definition of Chapter 3 gives the form: active and eligible users, recommendations shown and overridden, and a healthy range for each metric, with a minimum group size and no individual-level access (2, Nordqvist, 2026). For a toolbox the same reasoning applies at a different scale. An exception rate near zero may mean that nothing is checked, and a high rate may mean the rules are wrong or unwelcome. For Nordvik Region the natural unit is the team that has taken the policy engine over; the Region widens it one team at a time and reads the dashboard at each gate. For Hansa Mutual the unit is the market, because a tool that exists in the group repository and is applied in one country of seven is adopted in one country. The tool-level counterpart of the override rate is the bypass: a mandate that is circumvented by a shared credential, as AIDR-0553 retired for Hansa Mutual, is a tool that was used and not adopted (6, Nordqvist, 2026).
Retirements
The third measure is how many tools are retired, and against which criteria. Chapter 3 records the gap in this part of the series: the pieces of a retirement exist (retirement criteria in the decision record, the closing of a pilot, the exit clause, the expiry of knowledge) but there is no single artefact that records what was revoked, deleted and archived and who confirmed it. The two organisations assemble it differently. Nordvik Region's practice is AIDR-0018, written because retiring a procured system needs a new procurement; its retirements are slow and contractual, and its measure is whether an exit test has met its quality gate. Hansa Mutual's retirements are quick and technical, and the measure is whether the revoked credentials and deleted extracts have a recorded confirmation. A toolbox with no retirements in a year is not a sign of health. It is a sign that no tool was reviewed against its criteria, or that evidence which had expired was renewed without a test.
A fourth reading is common to the three. The records of both organisations show that most remedies existed before the diagnosis and that the diagnosis added the name, the owner, the test and the date (3, Nordqvist, 2026). The toolbox review adds nothing else. For each tool it asks for an owner, a last test, a clock, a measure of use and a retirement criterion, and a tool that lacks one is a finding.
Across the degrees of delegation
The toolbox changes with the degree of delegation, because evidence of a tool's use must be stronger as the tool acts with more authority. The table follows the degrees as the volumes define them. The tool families are those of Chapters 18, 19 and 20, and the Levels in the right-hand column are the ones the two organisations are recorded to use.
| Degree | What the toolbox must hold | Evidence a review asks for | Recorded use |
|---|---|---|---|
| Level 0 Advisory | Inventory entry, decision record, evaluation | Golden-set result and its date | Hansa Mutual's change-risk reviewer scores changes and informs the human decision |
| Level 1 Assisted | Evaluation, oversight record, adoption dashboard | Override rate within its healthy range | Nordvik Region's SOC triage assistant (EVAL-NR-SEC-001) |
| Level 2 Supervised | Mandate, decision-rights file, named approver | Approver identified; stop holders drilled | Nordvik Region's runbook runner (MND-NR-OPS-003); Hansa Mutual's configuration changes |
| Level 3 Bounded | Mandate with closed classes, observer manifest, stop path outside the agent, autonomy budget | Seeded-fault result, stop-drill duration against target, independence statement | Hansa Mutual's restart, certificate renewal, scale and S1 emulation |
| Level 4 Autonomous | Not used for irreversible production action, for action outside a change window or freeze, or for disabling the observer or the stop path | Not applicable to those classes; the profile records the ceiling | Neither organisation uses it for these classes |
The pattern is that the toolbox grows downwards in the table as authority grows. A year spent entirely at Level 2, as at Nordvik Region, needs fewer tools and demands fewer drills, and the Region's discipline is not to adopt the tools of Level 3 before it needs them. A year that reaches Level 3, as at Hansa Mutual, adds the observer, the stop path and the independence statement, and each carries its own clock.
Nordvik Region and Hansa Mutual
Nordvik Region ends the illustrative year with a small toolbox that a team of seven and a team of six can keep current: an inventory with tiers and retirement criteria, an obligation register and a policy engine adopted one team at a time, a procurement profile with an exit price, service and restore records with dates, one Level 2 mandate with named stop holders, and a short threat register. Its measures are the age of its evidence and the exit tests it passes, and it reads them with an internal audit function as challenger. Hansa Mutual ends the year with a larger toolbox in which the observer and the stop path are the tools that matter most, and it reads its measures per market and per agent identity. Both have the same rule: no tool is said to cover, recover or verify without a date.
Summary
The chapter draws four conclusions of its own, all following from the earlier chapters of this book and from the examples they cite.
- The order of a toolbox follows the gap, not the catalogue. Nordvik Region begins by making a high-risk system it procures legible (inventory, tier, decision record with retirement criteria), and Hansa Mutual begins by bounding agents that already act (mandate and delegation profile). The same tools appear in both toolboxes, in a different order.
- What an organisation leaves out is part of the design. Nordvik Region has no Mode 5 agent, so it leaves out emulation agents and continuous red teaming and buys testing; Hansa Mutual leaves out public readability and a uniform tool across seven regimes. A tool left out is recorded with the condition under which it returns.
- Three measures tell whether the toolbox works: the share of tools whose evidence is within its clock (180 days for a Tier 1 restore test, 90 days for a delegation profile and an exception), adoption by the unit for which the tool was chosen, and retirements against stated criteria. These are assembled from instruments of the earlier volumes; the thresholds beyond the cited numbers are illustrative.
- The toolbox grows with delegation. Level 2 needs a mandate and a named approver; Level 3 adds an observer, a stop path outside the agent and an independence statement, each with its own date. The measure that matters most at Level 3 is the one that can fail, as two cells of Hansa Mutual's purple loop did.
The year in this chapter is illustrative, as are its quarters. The record of the series remains that both organisations, in the diagnostic of The Transformed Security Architect, found that most remedies existed before the diagnosis. The tools are in the volumes, and what a toolbox adds is the name, the owner, the test and the date. Chapter 25 draws the book's conclusions, including the inconsistencies between the volumes that the findings files record.
Sources
- Nordqvist, G. AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (2, Nordqvist, 2026)
- Nordqvist, G. AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. (3, Nordqvist, 2026)
- Nordqvist, G. AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. (5, Nordqvist, 2026)
- Nordqvist, G. The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. (6, Nordqvist, 2026)
- Nordqvist, G. AI Purple: How Red and Blue Learn Together When AI Joins the Loop in European Enterprises and Public Authorities. (9, Nordqvist, 2026)
- Nordqvist, G. AI Operations: How Artificial Intelligence Transforms IT Operations in European Enterprises and Public Authorities. (10, Nordqvist, 2026)