{
  "version": 1,
  "title": "Shared drive outage",
  "objective": "Practice assigning an incident lead, deciding when to isolate affected systems, and agreeing on a staff update.",
  "injects": [
    {
      "minute": 0,
      "label": "Files stop opening",
      "prompt": "Several employees report that shared project files are suddenly unavailable. The help desk can still reach email and the status page.",
      "expected": "Name the incident lead and a note taker. Establish the timeline and decide which teams to involve.",
      "decision": "",
      "outcome": "pending",
      "owner": "",
      "action": ""
    },
    {
      "minute": 12,
      "label": "Scope widens",
      "prompt": "A second department reports renamed files. The systems team identifies an affected workstation and an unaffected backup location.",
      "expected": "Agree who decides on isolation, what evidence to preserve, and how to protect recovery options.",
      "decision": "",
      "outcome": "pending",
      "owner": "",
      "action": ""
    },
    {
      "minute": 25,
      "label": "Staff want an update",
      "prompt": "Managers ask when service will return. The service owner says recovery has started, but a restore test has yet to finish.",
      "expected": "Assign an update owner, distinguish verified facts from estimates, and set a time for the next update.",
      "decision": "",
      "outcome": "pending",
      "owner": "",
      "action": ""
    },
    {
      "minute": 40,
      "label": "Recovery checkpoint",
      "prompt": "A test restore succeeded for a small file sample. Staff are still using a temporary channel for urgent requests.",
      "expected": "Identify who can approve reopening, which validation checks remain, and which decisions need follow-up.",
      "decision": "",
      "outcome": "pending",
      "owner": "",
      "action": ""
    }
  ]
}