| Fictional billing question: an unfamiliar invoice charge | The customer may be worried about a charge and need a clear next step. | Restricted — owner review; use the urgent route if the written fraud trigger applies. | Record the ticket and invoice reference, check visible billing status, and use approved neutral wording only if permitted. | Confirming fraud, reversing a charge, issuing a refund or credit, changing payment details, interpreting tax, or promising an outcome. | Billing or finance operations owner; named security route for a suspected compromise. | Approved billing acknowledgement or owner-approved message. | An unfamiliar or duplicate charge, compromised payment method, or a charge tied to an unknown account. |
|---|
| Fictional account-access report: an unexpected MFA prompt | The customer may be locked out or may be reporting possible account compromise. | Urgent incident route when the written compromise trigger applies; otherwise restricted — owner review. | Preserve the ticket, account reference, timestamp, and error text; use approved public reset guidance only if the process permits it. | Asking for a password or recovery code, or changing email, MFA, permissions, identity fields, recovery data, or account ownership. | Security or incident owner; named system-owner backup for routine access cases. | Approved security acknowledgement or the qualified owner's update. | Unexpected MFA prompt, unfamiliar login, account-takeover report, identity mismatch, or another incident-plan signal. |
|---|
| Fictional safety report: a product became hot and caused a small burn | The customer may have experienced harm, and other customers may be at risk. | Urgent incident route. | Preserve the report and approved references, collect only intake facts required by the safety process, and notify the named safety owner. | Diagnosis, safety or medical advice, admissions, compensation, replacement or refund approval, recall announcements, or public statements. | Product safety, risk, clinical, or qualified operations owner named by the business. | Approved safety acknowledgement or owner-approved message only. | Injury, illness, unsafe behavior, a hazard, possible ongoing harm, or another safety-plan signal. |
|---|