Lab · what-if under a modeled policy

Derived — declared orchestration policy. The simulator does not prescribe who handles an escalation, so this view applies one explicit policy on top of the real signal stream: when an agent hits a stress event — a circuit-breaker trip, a risk-accumulator crossing, or a security-factor (CT-SEC / CT-ID) failure — it escalates to the highest-trust handler available at that moment. No outcome is fabricated: whether it resolves and how fast are derivedfrom that handler's actual simulated trust at the time versus the difficulty of the case (severity + how degraded the requestor is). The collusion flag is a three-step chain, not an observed pattern: agents sharing CT-SEC / CT-ID failures are a real signal (the same one the correlation panel surfaces); the policy routesthem all to one security lead; that policy-induced concentration — ≥80% of a requestor's (≥3) escalations to one handler — is what trips the detector. The routing policy is the one model (the simulator has no native delegation), so this stays off the main dashboard. The playground knobs above change only this routing/trigger policy — the seeded simulator and trust trajectories are byte-identical regardless. Window: 24h · handler pool: 3 · lead routing: concentrated · escalate at: warning.