Incident Master philosophy
Only the Incident Master reads this page before the session.
The Incident Master is not an expert with the answers. You are the person who keeps the process fair, keeps the secret, and asks the question that makes the table notice what it just did. This chapter sets the stance. The next ones give the mechanics.
Three jobs, one stance
You do three different jobs in one session, and players trust you only if they can tell which one you are doing.
- Referee. You call each d20 roll and state the target. The acting player throws. You apply the tracks and announce the clue tier. Be dull and predictable here.
- The other side. When one chair is empty you play it from a written script. Be exact here, not clever.
- Debrief lead. You ask the questions that turn a game into a lesson. Be curious here.
If you keep to the script as referee and as the other side, you have all your attention left to be curious in the debrief. That is the whole design.
“I will tell you the target before anyone rolls, every time. I will never tell you which Comrades move changed the clue tier until the debrief.”
The habits that carry the game
1. State the target, then roll
DEFAULT The IM calls the roll and states the d20 target before it. The acting player throws and reads the number aloud, and the roll succeeds at or above the target. The bands are Easy 8, Standard 12 and Hard 16. Saying the number first takes the suspicion out of the roll: no one can think you chose a target after seeing the die. Chapter 02 covers how to pick the band.
2. Judge the process, not the person
The game’s fair-play line is printed on the one-pager: Judge the process, not the person. Nobody is a suspect because of an accent, a passport or a face. In practice that gives you three rules for your own voice and your own cards:
- Say “persona”, never a nationality. The worker in the chair may be a subcontracted freelancer, or involvement may be hidden. Do not tell the table that workers are forced to do this.
- Say “assessed” or “suspected” when you speak about who stands behind a case. Never “it is certain”.
- Tells are behaviour, process and money: a ship-to address that does not match, a remote tool nobody approved, a payee that changed. When you play a hire, use a plain voice. No accent, no stereotype, no joke at a person.
The propaganda register belongs to the Comrades’ printed materials only: the kicker, headlines, section titles and stamps. You do not do a state-media voice at the table.
3. Keep the cause to yourself
The clue tier rises during play, and only a wrongful offboarding resets it to noisy. You announce the new tier and nothing else. When the rise came from a Comrades move (a scoring move that landed without cover, or a failed Comrades roll), you never name the cause until the reveal in the debrief. A rise from a costed lookup is the Company’s own act and is not hidden. Write each cause in the tier log as it happens. That log is what makes the reveal worth four minutes.
4. Protect the learning
Rounds are short and the clock is real. When the table is stuck, the printed rule is: set the d20 target yourself, say it aloud, and move on. A wrong call that keeps the game moving costs less than a perfect call after five minutes of talk.
Your role: guide, not expert
What you are:
- Process guide: you run the loop, the clock and the tracks.
- Fair referee: the same standard applies to either chair.
- Question asker: you open up the table’s thinking rather than supplying it.
- Safety keeper: you keep the room fit for anyone to try, fail and say so.
What you are not:
- The security expert: the players bring that knowledge, and they may disagree with each other.
- The answer provider: you never tell them which hire is the persona, or whether a call was right, before the debrief.
- A lecturer: the debrief carries the teaching, and the players write their own transfer.
- A hidden player: you do not steer the table toward the sealed hire.
The questions you ask
Discovery questions
Purpose: help the table notice what is on the cards.
- “What do the 3 hire cards have in common? What differs?”
- “Which of those facts is process, which is money, and which is only looks?”
- “What would you want to check before you trust this address?”
Avoid answer-seeking (“Does anyone think it is hire two?”) and solution-directing (“You should check the payee”).
Collaboration questions
Purpose: get the roles working together.
- “Which role is best placed to act on that?”
- “SecOps found the log, what does Finance & Legal do with it?”
- “Who has not yet used both actions this round?”
Reflection questions
Purpose: tie play to real work. Most live in the debrief.
- “Which accusation rested on a named control, and which on a look?”
- “What would have stopped that move in your own organisation?”
- “What changed the clue tier, and did you see it coming?”
The question banks hold the full lists.
Psychological safety
The cell plays a fraud scheme. Some players will find that fun, some will find it awkward, and some will have a personal reason to find it hard. Set the room before round 1.
Encourage trying:
- “There is no single right answer here. What would you try?”
- “That is a move I had not thought of. How does it help?”
Normalise uncertainty:
- “Real hiring fraud is noisy. The tier starts there for a reason.”
- “It is fine not to know. What would you do to find out?”
Name the X-card. One sentence, once, at the start: “If anything on a card or in a question is a problem for you, tap the X-card or say so, and we move on without a discussion.” Details are on the safety and X-card page.
Players who have seen hiring fraud first-hand may bring that into the room. You can offer a quick break rather than a debate. Skipping this never breaks a session.
Balancing structure with flexibility
The rules are tight on purpose. The flexibility is in how you talk, not in what you rule.
When talk drifts into technical detail: “That is good analysis. Which role acts on it, and what is the target?”
When the table is stuck: “Set the target, say it, move on.” Then do exactly that.
When energy drops: “Both tracks are visible. What does the table want to move?”
Adapting to the group
- High-expertise groups: push the named-control question harder. “Name the exact control, not the category.”
- Mixed groups: let the experts explain a control to the newcomer, then let the newcomer decide the action.
- Low-expertise groups: use the free actions (Ask, Look, Hold) more, and stay on one idea per round.
What you do not need
- Deep DPRK background. The opening script is under 3 minutes and assumes none.
- Perfect cases. The case file carries the facts. You read them as written.
- All the answers. The debrief asks the table to write its own.
What next
Read Preparing the session, then keep Running the session open for your first round.