War-game a penalty box policy before hold criteria, appeal paths, and release rules harden into how every flagged account gets treated.
Penalty box policies fail when the doc invents detection precision the signals never had, when holds dual-count the same account as restricted and as released, when support still promises exceptions in private Slack, and when trust cannot show which holds actually cleared under the published criteria. A neat enforcement flowchart is not evidence.
Freeze one policy
State the proposed hold triggers and durations, which products and account types it covers, who owns appeals and release audits, what success looks like after two quarters of false-positive rate and time-to-release, and the kill criteria if shadow exceptions or appeal disputes past a named threshold. Attach the signal list, sample hold logs, appeal queue notes, and the measured path from flag to release. If trust, support, and product disagree on whether the policy buys safety or just deferred customer fights, reconcile before seating.
Name the decision you will make if the war game finds nothing new, and the hold criteria if any trigger still lacks a named owner or a verified appeal path.
Hostile seats
- Flagged customer. Fear that "temporary hold" still means weeks without a named reviewer.
- Support lead. Macros that look clean while the appeal queue has no weekend owner.
- Product. Feature language that invents access the hold still blocks.
- Trust analyst. Signal thresholds that still host retired false-positive rates.
- Skeptic. The claim that looks strongest and is least sourced.
Optional legal seat if regulated account types bind the form. Same pack for every seat.
Private pass
Feed Pingpong the policy draft and exhibits. First pass steelmans the hold logic. Later passes attack from the seats above. Final pass turns surviving objections into clearer triggers, a published appeal SLA, or a pause. Delete invented "customers already understand temporary holds" claims and dual-counted release rates.
Force a day-after narrative: what happens if a large account screenshots mismatched hold reasons, if support still teaches unwritten release paths, or if trust cannot list the open cohort. If those stories are stronger than your mitigation plan, fix the package before you publish it. Separate a penalty box policy from a support escalation ladder or a community guidelines change so each decision stays testable.
Ask every seat to mark which appeals are optional in practice. Optional release audits become skipped within a month if nobody names the owner and the time box. Related: pretend you are the fraud analyst, pretend you are the angry customer, pretend you are the support director, and the war-game decisions hub. Process: how to run a Pingpong.