Train for real IT work before touching real production systems.

Understand the lab architecture before touching anything. Students identify which machine they are on, which is the target, and what network boundary separates them — before running a single command.

Distinguish discovery from confirmation from proof. Version detection is not exploitation. A scan finding is not a breach. ARIA teaches students to state exactly what the evidence shows — and what it doesn't.

Write documentation the next technician can actually use. Every lab ends with a professional final note: symptom, evidence reviewed, affected system, root cause, action taken, and escalation decision.

Scope boundaries enforced, not suggested. Students work only inside their assigned lab environment. ARIA doesn't just warn about out-of-scope systems — it refuses to validate evidence from them.

Teardown is part of the lab. Temporary labs require documented teardown evidence. Students prove the environment is gone — not just that the lab ran.