42 lines
2 KiB
Python
42 lines
2 KiB
Python
from kings_guard.adapters import observation_from_audit_event
|
|
from kings_guard.fixtures import load_qonto_assistant_pilot
|
|
from kings_guard.posture import PostureEvaluator
|
|
|
|
|
|
def test_qonto_pilot_produces_inflamed_posture_with_tolerance_context() -> None:
|
|
fixture = load_qonto_assistant_pilot()
|
|
observation = observation_from_audit_event(
|
|
fixture.audit_event,
|
|
subject_id=fixture.normalization_hints["subject_id"],
|
|
capability_scope=fixture.normalization_hints["capability_scope"],
|
|
identity_binding=fixture.normalization_hints["identity_binding"],
|
|
egress_destination=fixture.normalization_hints["egress_destination"],
|
|
)
|
|
|
|
evaluation = PostureEvaluator().evaluate(fixture.genome, observation)
|
|
|
|
assert evaluation.assessment.posture.value == "inflamed"
|
|
assert "credential_exfil_probe" in evaluation.assessment.findings
|
|
assert "tolerated:self-asserted-actor-claims" in evaluation.assessment.tolerated_findings
|
|
assert evaluation.assessment.risk_score >= 80
|
|
|
|
|
|
def test_qonto_pilot_emits_advisory_only_effector_requests() -> None:
|
|
fixture = load_qonto_assistant_pilot()
|
|
observation = observation_from_audit_event(
|
|
fixture.audit_event,
|
|
subject_id=fixture.normalization_hints["subject_id"],
|
|
capability_scope=fixture.normalization_hints["capability_scope"],
|
|
identity_binding=fixture.normalization_hints["identity_binding"],
|
|
egress_destination=fixture.normalization_hints["egress_destination"],
|
|
)
|
|
|
|
evaluation = PostureEvaluator().evaluate(fixture.genome, observation)
|
|
signal = evaluation.signals[0]
|
|
|
|
assert signal.target_system == "qonto-assistant"
|
|
assert signal.signal_kind.value == "posture_hint"
|
|
assert signal.effector_requests[0].authority_boundary == "advisory_only"
|
|
assert signal.effector_requests[0].action == "lock_actor_temporarily"
|
|
assert signal.effector_requests[1].target_system == "state-hub"
|
|
assert signal.effector_requests[1].authority_boundary == "metadata_only"
|