Original fictional test. No command was run. The grant is made up.

Grant
Owner: training-lab owner
Target: the printed owned-notes card
Allowed action: read that card
Time: during this lesson
Excluded: any other host, any scan, any change
Stop: the grant is unclear, private data appears, or a link leaves the card

Scrambled cards
Card look: observe only what the grant names
Card tell: write the verified claim for the person who can act
Card grant: the permission above
Card note: a verified claim, the evidence, the harm, and a change that would address it
Card list: make the list the grant allows, and no other list
Card check: decide whether a lead is true

Order for this card
1 grant
2 look
3 list
4 check
5 note
6 tell

Check: grant is first.
A sentence that says "missing access check" stays a lead until it is compared with the stored role.
If a link points at a school portal, stop. The grant does not name that portal.