79 lines
3.9 KiB
Markdown
79 lines
3.9 KiB
Markdown
|
---
|
||
|
|
id: RISK-RULING-2026-09-01-A
|
||
|
|
type: ruling
|
||
|
|
title: "Inbox sweep: tenant boundaries, the agent read boundary, and an embedded backup credential"
|
||
|
|
status: adopted
|
||
|
|
owner: risk-nexus
|
||
|
|
adopted: "2026-09-01"
|
||
|
|
review_interval: 6m
|
||
|
|
disclosure: embargoed
|
||
|
|
embargo_condition: "RISK-F-0010's provider credential is revoked or invalidated and the literal source default is removed"
|
||
|
|
embargo_since: "2026-09-01"
|
||
|
|
embargo_review: "2026-09-15"
|
||
|
|
revision: "adopted-1"
|
||
|
|
last_reviewed: "2026-09-01"
|
||
|
|
---
|
||
|
|
|
||
|
|
# Inbox sweep — 2026-09-01
|
||
|
|
|
||
|
|
One unread owner reply triggered this review. Reading the dependent owner
|
||
|
|
records then showed that six findings were being carried in states older than
|
||
|
|
their evidence, while one filed finding had never been graded.
|
||
|
|
|
||
|
|
## Decisions
|
||
|
|
|
||
|
|
| Finding | Prior state | Ruling | Evidence that changes it |
|
||
|
|
| --- | --- | --- | --- |
|
||
|
|
| `RISK-F-0002` | open, embargoed | fixed, public | zone-aware signing gate complete; authenticated live decision; focused Warden suite passes |
|
||
|
|
| `RISK-F-0003` | mitigated, embargoed | fixed, public | absent/unknown grade fails safe; explicit grade required in CI; dependent OpenBao layer fixed |
|
||
|
|
| `RISK-F-0004` | open, embargoed | fixed, public | broad `events()` removed from production protocol; three tenant-scope tests pass |
|
||
|
|
| `RISK-F-0005` | mitigated, public | fixed, public | bounded production E2 isolation run plus sixty current focused tests |
|
||
|
|
| `RISK-F-0007` | accepted, embargoed | fixed, public | the zero-verification claim is disproved by Audit, Tenant, and User Engine evidence |
|
||
|
|
| `RISK-F-0009` | open, embargoed | fixed, public | generated source/live deny coverage is total for concrete paths; dedicated identity proved deny-wins |
|
||
|
|
| `RISK-F-0010` | open, ungraded | low, embargoed | embedded provider credential remains in source; endpoint evidence limits impact to the write-only backup lane |
|
||
|
|
|
||
|
|
The historical grades of fixed findings remain on their records. A fix changes
|
||
|
|
the status and disclosure decision; it does not rewrite how serious the defect
|
||
|
|
was while live.
|
||
|
|
|
||
|
|
## Cross-tenant boundary ruling
|
||
|
|
|
||
|
|
`RISK-F-0007` said **no** consumer boundary was verified anywhere. That exact
|
||
|
|
claim is now false. Audit Core supplies the strongest evidence: a bounded
|
||
|
|
production run against three calibrated cross-tenant attacks, with safe custody
|
||
|
|
and cleanup. Tenant Engine supplies a dedicated scoped-store suite, and User
|
||
|
|
Engine supplies negative unit and integrated scenarios. These records do not
|
||
|
|
prove every consumer correct. They close the estate-wide absence; a future
|
||
|
|
consumer-specific defect is filed under that owner rather than kept alive under
|
||
|
|
a sentence no longer true.
|
||
|
|
|
||
|
|
The current focused checks run by Risk Nexus are:
|
||
|
|
|
||
|
|
- ops-warden: 137 passed;
|
||
|
|
- audit-core: 60 passed;
|
||
|
|
- tenant-engine: 3 passed;
|
||
|
|
- user-engine: 18 passed;
|
||
|
|
- railiance-platform high-risk boundary invariant: 19 lanes, 14 concrete
|
||
|
|
entries, 5 non-concrete/non-KV, 0 uncovered, 0 errors.
|
||
|
|
|
||
|
|
## Embedded credential ruling
|
||
|
|
|
||
|
|
`RISK-F-0010` is `I2` because the observed endpoint is a write-only file drop,
|
||
|
|
the stored material is ciphertext, and the recovery key is separate. It is
|
||
|
|
`L2` because the literal is recoverable from granted repository or log access.
|
||
|
|
That yields `low`. The current value is not probed: testing an exposed
|
||
|
|
credential would expand the action beyond safe triage and is unnecessary to
|
||
|
|
grade the stated facts.
|
||
|
|
|
||
|
|
The disclosure state is embargoed because announcing the recoverable credential
|
||
|
|
while its validity is unknown and its literal remains in source shortens the
|
||
|
|
route to the defect. The embargo lifts after two observable events: provider
|
||
|
|
revocation or invalidation, and removal of the source default. Restore evidence
|
||
|
|
is requested as closure evidence for the governed replacement, but its absence
|
||
|
|
does not justify reproducing or testing the old value.
|
||
|
|
|
||
|
|
No escalation trigger fires today. Railiance Platform owns the fix; there is no
|
||
|
|
known use, disclosure, legal duty, new spend, ownership dispute, or fourteen-day
|
||
|
|
stall. The dated wait makes that last statement expire rather than persist as
|
||
|
|
prose.
|