Lab · derived under a modeled policy

Derived — declared orchestration policy. The simulator does not prescribe who handles an escalation, so this view applies one explicit policy on top of the real signal stream: when an agent hits a stress event — a circuit-breaker trip, a risk-accumulator crossing, or a security-factor (CT-SEC / CT-ID) failure — it escalates to the highest-trust handler available at that moment. No outcome is fabricated: whether it resolves and how fast are derivedfrom that handler's actual simulated trust at the time versus the difficulty of the case (severity + how degraded the requestor is). The collusion flag is a three-step chain, not an observed pattern: agents sharing CT-SEC / CT-ID failures are a real signal (the same one the correlation panel surfaces); the policy routesthem all to one security lead; that policy-induced concentration — ≥80% of a requestor's (≥3) escalations to one handler — is what trips the detector. The routing policy is the one model (the simulator has no native delegation), so this stays off the main dashboard. Window: 24h.