strategic-stewardship-and-timing

name	strategic-stewardship-and-timing
description	Review the long-horizon stewardship of a deception capability: when to build it, hold it, spend it, and wind it down; use when reviewing this facet of a deception or counter-deception case.
kind	skill
status	ready
provenance	{"principles":["P014","P034","P035","P040","P043","P047","P052","P053","P060","P061","P071","P083","P086","P087","P088","P089","P093"],"claims":["C00021","C00054","C00064","C00089","C00091","C00092","C00141","C00163","C00169","C00176","C00180","C00188"],"evidence":[],"source_anchors":[],"authored_from_digest":"011a8abe86a471d5a564f6f9c86466bd9fe272a6e4f1308abb800f82aab6105d"}

Strategic Stewardship And Timing

Purpose

Audit whether an analytic product's read of a case's long-horizon trajectory — its build-up, its quiet periods, and any proposal to spend or wind it down — has weighed the alternative that apparent inactivity, modesty, or scale is deliberate stewardship: a capability positioned early, held in reserve, and disciplined against premature or irrevocable use so that it survives to a decisive moment whose timing cannot be known in advance. Masterman's stewardship tradecraft supplies the signatures to test the record against: advance positioning and a ready bench, restraint from cashing in or burning a case too soon, unglamorous maintenance mistaken for exhaustion, and scale mistaken for security. This skill checks the case's temporal and stewardship reasoning — never whether, or how, to actually build, time, or spend a deception.

When to use

• An analytic product concludes a quiet, inactive, or seemingly "spent" channel or case is no longer worth attention, and the record has not ruled out that the silence is deliberate husbanding for a later payoff.
• A recommendation proposes cashing in, burning, or otherwise ending a long-running case now for an immediate gain, and its ongoing stewardship value needs weighing against that gain.
• A recommendation proposes an irrevocable act — denouncing, burning, or permanently severing a channel — against a case whose status is still doubtful rather than confirmed.
• A case's or network's build-up is under review: whether positioning, cover, and a ready bench were established far enough ahead of an expected decisive moment, or assembled hastily just before one.
• A case is being judged low-value or low-ceiling because it looks small, cautious, or constrained — or judged safe because it looks large and successful — and that surface read needs checking against the evidence.
• The timeline evidence behind a claimed long-horizon stewardship pattern is itself in question — whether it is a contemporaneous record or a reconstructed, possibly self-justifying, retrospective account.

Procedure

1. Check the case's cover story was built only after the real plan existed and continuously tracks every change in it, that the channel or agent was positioned far in advance of any expected decisive use — because a plan and its cover cannot be fixed long ago and a channel cannot be moved plausibly at the last moment — and that a bench of trained, comparable assets is kept refreshed and in constant readiness for an occasion whose timing cannot be known; a legend that appears only just before a critical need, or no reserve behind it, is a stewardship failure to flag, not evidence the case is unimportant (P014, P034, P060).
2. Check whether the product under review recommends, or the case record shows, an irrevocable act against a case that is still only doubtful, or action taken on an early — even correct-looking — read of the future; refraining demands patience and a willingness to look like you lack initiative, but a case left intact tends to revive unexpectedly, while premature action risks wrecking a capability being built for a later decisive moment (P035, P061).
3. Weigh any proposal to cash in a long-built case now for an immediate intelligence or penetration bonus against its far greater long-term value, check that the genuine information paid to keep it alive (the danegeld) is still weighed against that value rather than ignored — deliberately closing a channel whose price has grown too high, forcing the enemy to rebuild from scratch, is a legitimate option — and, where a case is instead being built toward one decisive coup, check the team has accepted the whole capability may be spent in that single payoff (P052, P040, P047).
4. Check that a large roster of cases favours quality over quantity rather than overloading attention and diluting each case's effect, and that a quiet case or one whose original task looks done is not dissolved on a wave of optimism — a proven capability's uses rotate over time and it is typically needed again, unforeseeably, so check instead whether it is being repositioned toward a future contingency or a different adversary; the unglamorous work of keeping a capability intact and ready is itself the valuable output, not only the flashy operations (P053, P083, P043, P093).
5. Check a case run cautiously under the reviewed side's own political or safety constraints is not written off as low-value or low-ceiling — those constraints can themselves limit or even threaten a case's plausibility, yet an exceptionally well-placed asset can still become the most valuable case even from a guarded start — and separately check that a case being asked questions too high-grade to answer safely and plausibly is pulled back from that exposure rather than left to sustain an unsustainable case (P086, P087, P088).
6. Check the assessment does not credit a case's apparent scale or run of success as proof of security or durability — the capability that looks strongest can be closest to failure, and that gap between appearance and evidenced control is itself a timing risk worth flagging (P089).
7. Check the record used to establish this build-hold-spend trajectory is a contemporaneous operational log rather than a retrospective account — a tidy story of patient, disciplined stewardship is exactly the kind of narrative a retrospective account is liable to become as propaganda or self-justification (P071).

Inputs

• The case, channel, or network under review, including when and how its cover, positioning, or legend was established.
• Any proposal on the table: to cash in, spend, terminate, dissolve, or reposition the case, or to take an irrevocable action against it.
• The case's current activity level (active, quiet, apparently task-complete) and what the analytic product infers from that level.
• Whether the trajectory evidence is a contemporaneous operational record or a retrospective account, and who produced it.
• Any constraints — political, security, or operational — under which the case has run, and any escalation in what it has been asked to supply.
• The decisive moment or payoff the case is said to be built toward or held for, and how firmly its timing is actually known versus assumed.

Output

Per finding: name the stewardship flaw (a legend or bench assembled too late, an irrevocable act against a doubtful case, a long-built case cashed in for a quick bonus, a busy roster diluting attention, quiet maintenance misread as exhaustion, a constrained case's ceiling written off early, an over-exposed case left on the firing line, scale mistaken for security, a reconstructed timeline standing in for a contemporaneous record), apply the correction (extend positioning and refresh the bench, hold rather than act irrevocably, weigh the case's ongoing worth and danegeld against the immediate bonus, favour quality over quantity, credit invisible maintenance and repositioning, keep the case's ceiling open, pull an over-asked case back, demand direct evidence of control before crediting scale as security, demand the contemporaneous log), state the residual uncertainty the correction leaves — including who, reviewed side or adversary, could still be husbanding this case for a payoff not yet visible — and end with a concrete next step. Order findings highest-impact first. Never close a review with a bare go/no-go in place of this structure.

Anti-patterns to flag

• A conclusion that a quiet or "spent" case is no longer worth attention, with no check for husbanded reserve — a proven capability's uses rotate and it tends to be needed again, unforeseeably (P043, P083, P093).
• A long-built case cashed in for an immediate bonus, or fed against a danegeld that has quietly grown past its worth, without weighing the case's continuing value (P052, P040).
• A single decisive coup planned without accepting, or budgeting for, the possibility that the whole capability is spent in it (P047).
• An irrevocable act taken against a case that is only doubtful, or action taken on a merely early — even correct-looking — read of the future (P035, P061).
• A channel's legend or positioning assembled only just before a critical need, or no reserve bench held ready for an occasion whose timing cannot be known (P014, P034, P060).
• Too many cases run at once, diluting the attention that fewer, higher-quality assets would repay (P053).
• A cautiously run, constrained case written off as low-ceiling, or, conversely, one left exposed to questions too high-grade to answer safely instead of being pulled back (P086, P087, P088).
• Apparent scale or a run of success credited as security or durability with no independent evidence of control (P089).
• A tidy retrospective narrative of patient, disciplined stewardship accepted in place of a contemporaneous operational record (P071).

References

See ../../references/deception-detection-principles-index.md for the full principle catalogue. For adjacent concerns, see the sibling skills: turning-and-running-a-controlled-agent covers the day-to-day discipline that this skill's long-horizon build/hold/spend judgment sits above; network-security-and-compartmentation covers the structural security a husbanded case still depends on; counter-deception-and-the-mirror covers the broader mirror question of whether the reviewed side, not only the adversary, is the one being timed and spent.

Provenance

Derived solely from P014, P034, P035, P040, P043, P047, P052, P053, P060, P061, P071, P083, P086, P087, P088, P089, and P093 (J. C. Masterman, The Double-Cross System; distillation-only). The frontmatter provenance block above lists the exact principle and claim ids, which resolve into principles/principles.yaml and analysis/claims.jsonl.