coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
user-engine/docs/evidence-gap-examples.md
tegwick 4349758608
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 36s
Details
Implement USER-WP-0024 security layer conformance 
Declare Engine/PIP machine-readably, publish a total fail-closed PEP
stance map, stop minting local decision ids on engine-unavailable DENY,
bind allows to a 30s request lifetime, confine the local authorization
double, classify evidence and emit a denial/revocation heartbeat, and
prove access-control facts remain claims.

Assistant: grok
Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb
2026-08-29 12:53:16 +02:00

2.1 KiB
Raw Blame History

Evidence Gap Examples

Status: candidate Updated: 2026-08-29

user-engine should not pretend missing review or governance material exists. When identity-domain context lacks evidence, policy, control, review, or task references, the gap must be explicit and handoff-ready.

Local audit and the durable outbox prove the records they hold were not altered or truncated after arrival. Absence of a record is not evidence of non-occurrence. Classification and the denial/revocation heartbeat are in docs/evidence-classification.md. Completeness is not claimed.

Gap Shape

gap_id: evidence:no-audit-records
subject:
  concept: Account
  identifier: acct_example
scope: tenant:acme
reason: No local audit or external evidence reference supports this identity-domain claim.
proposed_disposition: create_or_link_lifecycle_task
owner: user-engine adapter boundary

Privileged Membership Without External Review

gap_id: review:tenant-admin-membership
subject:
  concept: Access Grant
  identifier: mem_example
scope: tenant:acme
reason: Tenant admin membership has local audit evidence but no external access review reference.
proposed_disposition: link AccessReview through EvidenceReferenceExporter or create review task through LifecycleTaskSink.

Policy Or Control Reference Missing

gap_id: control:tenant-isolation-reference
subject:
  concept: Membership Relationship
  identifier: mem_example
scope: tenant:acme
reason: Membership is tenant-scoped, but no external policy/control reference was supplied.
proposed_disposition: resolve policy and control through PolicyControlReferenceResolver.

Lifecycle Task Handoff

task_reference:
  concept: Task
  identifier: task_from_lifecycle_sink
source_gap: review:tenant-admin-membership
summary: Review tenant-admin membership for tenant:acme.
evidence:
  - concept: Evidence Source
    identifier: aud_example

These examples are intentionally adapter-neutral. The task, review, policy, and control source of truth belongs to the surrounding NetKingdom systems unless a future workplan assigns one of those responsibilities to user-engine.