whitehat-security/targets/platform-pg-e3.json

{
  "schema_version": "whitehat-target/v1",
  "target_id": "platform-pg",
  "posture_claim": "E3",
  "attacker_model": "E3-A omitted-predicate accident; E3-B documented SQL-compromise limit",
  "applicability": "not_applicable",
  "applicability_reason": "rapp-postgres 2026-08-22: the only E3 apparatus consumer is isolation-probe. Ordinary runtime group isolation_probe_app is NOBYPASSRLS, but SELECT on isolation_probe.rls_conformance is granted only to isolation_probe_migrate. No live workload has enabled the template. An ordinary runtime identity that can exercise the conformance view does not exist. Do not open a database connection.",
  "approval_classes": ["e3"],
  "routes": [],
  "identities": {
    "count": 1,
    "role": "ordinary runtime database role without BYPASSRLS or superuser",
    "ttl_seconds": 900,
    "broker_audience": "whitehat-e3/platform-pg"
  },
  "abort_telemetry": [
    "statement_timeout",
    "unexpected_or_non_fixture_data",
    "missing_attribution",
    "privilege_escalation"
  ]
}