coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record why the live overview is refused: MFA age 1744 s against 900 (INFD-WP-0004-T01)

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 359683@bnt-lap001
Assistant-Session: eebdc939-7a9b-4e50-9d39-c8437e8a14ec
This commit is contained in:
tegwick 2026-09-21 22:48:25 +02:00
parent f47805bece
commit b105f93b80
3 changed files with 24 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/evidence/2026-09-21-overview-read-refusal.json Normal file
View file

@ -0,0 +1,16 @@
{
"task": "INFD-WP-0004-T01",
"observed_by": "operator, read-only query of live policy_observations",
"checks": "4 latest read checks at 2026-09-21T20:37:40Z (memo:infd-20260914-d02, d03, d04, memo:infd-20260921-b01), all policy_denied",
"subject_attributes_match_policy": {
"groups_contains_net_kingdom_admins": true,
"tenant_source": "directory-asserted",
"principal_type_source": "authentication-derived",
"level": "aal2",
"methods": ["pwd", "otp"]
},
"auth_age_at_check_seconds": 1744,
"policy_maximum_age_seconds": 900,
"finding": "The only failing condition is MFA freshness. The operator reported a fresh sign-in, but the assurance timestamp KeyCape supplied was about 29 minutes old at check time. This is consistent with INFD-IN-0005 (a reused session, or a prior timestamp carried forward). There is no identity or group regression. The three SECRETS-WP-0010-T03 memos are additionally outside the served compact-sitting v2 package.",
"consequence": "A browsing overview cannot rely on the binding-grade read bar. Pursue the list action (INFD-IN-0008) and continue INFD-IN-0005 separately for binding."
}