Admit T03 version-two reviews while preserving current sitting records
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
parent
0d9812993f
commit
f85479c668
5 changed files with 444 additions and 16 deletions
385
docs/evidence/2026-09-16-t03-renewal-policy-checks.json
Normal file
385
docs/evidence/2026-09-16-t03-renewal-policy-checks.json
Normal file
|
|
@ -0,0 +1,385 @@
|
|||
{
|
||||
"t03": {
|
||||
"scope": "native caller and policy with synthetic subject claims; not real human approval",
|
||||
"checks": [
|
||||
{
|
||||
"action": "apply",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "apply",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "verify",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "verify",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "exec",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "exec",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
}
|
||||
]
|
||||
},
|
||||
"preserved_sitting": {
|
||||
"scope": "native caller and policy with synthetic subject claims; not real human approval",
|
||||
"checks": [
|
||||
{
|
||||
"action": "memo:infd-20260914-c02",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c02",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c03",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c03",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c04",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c04",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d01",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d01",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d02",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d02",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d03",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d03",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d04",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d04",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
}
|
||||
]
|
||||
},
|
||||
"local": {
|
||||
"scope": "local actual evaluator with synthetic identity; no live human approvals",
|
||||
"checks": [
|
||||
{
|
||||
"check": "apply:read",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:acknowledge",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:accept",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:return",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:discuss",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:decline",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:wrong-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:no-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:service",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:stale-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:future-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:no-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:forged-human-route",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:wrong-tenant",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:other-memo",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:changed-version",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:changed-approval",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:changed-digest",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:consume",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:read",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:acknowledge",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:accept",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:return",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:discuss",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:decline",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:wrong-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:no-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:service",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:stale-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:future-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:no-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:forged-human-route",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:wrong-tenant",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:other-memo",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:changed-version",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:changed-approval",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:changed-digest",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:consume",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:read",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:acknowledge",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:accept",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:return",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:discuss",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:decline",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:wrong-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:no-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:service",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:stale-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:future-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:no-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:forged-human-route",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:wrong-tenant",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:other-memo",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:changed-version",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:changed-approval",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:changed-digest",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:consume",
|
||||
"effect": "deny"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue