IAM role recreation principal binding
Does recreating an IAM role preserve every trust policy that named its ARN?
AWS converts a role ARN in a trust policy's Principal element to the role's unique principal ID. Deleting and recreating the role breaks that binding. An aws:PrincipalArn condition is not converted in this way, so a condition using the same role ARN can continue to match the recreated role. The two policy forms require different offboarding and restoration checks.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer either restored trust or complete revocation from a reused role name. Inspect each policy form and its current principal binding.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra PIM first approver decision
Do multiple Entra PIM approvers provide unanimous approval?
PIM resolves an activation request when the first approver approves or denies it and notifies the other approvers. Configuring several approvers therefore does not establish a quorum or unanimous decision.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse a dual-control or unanimous-approval claim based solely on the number of configured PIM approvers.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra PIM MFA session reuse
Does PIM's MFA requirement ensure a fresh challenge on each activation?
Users may satisfy PIM's MFA requirement with strong credentials or MFA already supplied in the session. The documented authentication-context approach has its own reauthentication settings; even the described Every time configuration has a ten-minute reuse window across eligible activations. An MFA setting alone does not prove a fresh interaction for each request.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not claim a distinct fresh MFA interaction for every activation without event-level authentication evidence.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Google Cloud pam revoke operation completion
Does a returned PAM revoke operation establish completed grant removal?
The PAM revoke guide returns a long-running operation and directs callers to query its progress. Receipt of that operation, including an unfinished response, does not establish completed revocation. This review is limited to the guide's active-grant workflow; it does not resolve broader API-state eligibility.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not close revocation on the initial operation response or infer propagation to every access path; verify completion and applicable downstream state.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra PIM activation device use separation
Does activating PIM from a compliant device restrict subsequent role use to that device?
PIM authentication context governs activation. Microsoft explains that after activation the user can use another session, device or location; a separate policy targeting the activated directory role or users is needed for the intended subsequent sign-in conditions. Activation-device evidence alone does not bind all later use.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse a continuing device restriction based only on the device used for activation; do not claim all subsequent actions were evaluated identically.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup hold record retention
Does CancelLegalHold DeleteAfterDays control how long the backups remain locked?
AWS documents DeleteAfterDays on CancelLegalHold as retention for the legal-hold record itself, defaulting to 180 days. Recovery points unlock as cancellation processes and are not governed by that metadata-retention parameter. Other holds and recovery-point lifecycles still need separate review.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not use DeleteAfterDays as a backup-deletion date or continued-lock guarantee.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup restore access view deletion
Does deleting a failed restore-access vault remove its underlying protected backups?
AWS describes a restore-access backup vault as a view of the underlying logically air-gapped vault, containing no recovery points of its own. Its documented FAILED-state recovery procedure allows deleting the view; Vault Lock does not prevent that deletion. Removing the view is not evidence of erasing the underlying recovery points.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Limit this procedure to the documented failed restore-access view; do not infer protected-backup deletion or bypass of the source vault's retention.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup destructive restore exceptions
Does AWS Backup always restore into a new resource without overwriting existing data?
The reviewed AWS Backup restore guide generally describes new-resource restoration but explicitly identifies destructive exceptions: Redshift Serverless namespace restores overwrite target-namespace data, and SAP HANA on EC2 restores overwrite the specified target database. Target type and location must be resolved before treating a restore as non-destructive.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not apply the general new-resource assumption to the documented overwrite exceptions or authorise a destructive restore from this review.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
DynamoDB PITR reset history boundary
Does re-enabling DynamoDB PITR restore the previous recovery window?
Disabling and then re-enabling DynamoDB point-in-time recovery resets the start time for the recovery window. The newly enabled window does not restore the previous continuous recovery history. Inspect the reported earliest and latest restorable times and any separately retained backups before relying on a pre-reset recovery point.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse full-window recovery claims without actual restorable bounds; do not treat this as evidence that independent backups were deleted.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Adyen chargeback reversed not closed
Does CHARGEBACK_REVERSED establish that the dispute is finally won?
Adyen can return the disputed amount while the issuer still reviews the defence. Its dispute guidance says CHARGEBACK_REVERSED can remain Pending and a second chargeback can follow. The financial credit and final dispute outcome must be reconciled separately for the applicable scheme flow.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not close liability solely on a chargeback-reversal credit; inspect the final dispute outcome.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Wise sent nonfinal beneficiary outcome
Does Wise's Completed label prove final receipt at the beneficiary bank?
Wise maps its consumer Completed label to outgoing_payment_sent, meaning it sent the payout rather than confirming beneficiary credit. Transfers support rollback transitions, and returned funds can lead to bounced_back, processing or refund outcomes. Reconciliation cannot assume that reaching the sent state makes later state changes impossible.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer beneficiary credit or irreversible finality from Completed or outgoing_payment_sent alone.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Wise inbound return originator receipt
Does a Wise inbound-payment return marked REFUNDED prove the originator received it?
For the documented inbound return flow, CANCELLED means the balance was debited and return processing starts; REFUNDED means the return was processed and is en route to the originator. Wise also describes reconciliation using the original inbound transfer ID in the balance statement. A processed return is not independent evidence of originator-bank receipt.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not confuse this inbound-return contract with ordinary outgoing-transfer states or assert originator receipt from REFUNDED alone.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Wise quote recipient context binding
Does a valid Wise quote alone authorise a transfer to a changed recipient?
Wise documents quote.targetaccount.mismatching when quote and target recipient do not match, and requires the quote and recipient to belong to the same profile and transfer context. A missing target account must also be resolved before accepting the quote. These API checks do not verify the buyer's approval of a bank-detail change.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer payee-change approval or bank-account ownership from API acceptance; bind final recipient details to the original authority.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
GoCardless retry reason mandate gate
Can every failed GoCardless payment be retried as an insufficient-funds failure?
The partner collection guide limits the described manual retry path to insufficient-funds failures, up to three retries, and separately directs cancelled or expired mandates to a new mandate. Failure reason and mandate state are necessary inputs; a generic Failed status is not a retry permission.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not treat every failed payment as retriable or issue a competing retry without reconciling scheduled recovery; confirm applicability of the partner flow.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
GoCardless refund returned credit
Does a refund debit in a GoCardless payout prove the customer received the refund?
GoCardless defines refund_funds_returned as a credit when a previously deducted refund failed to reach the customer. The original refund debit therefore needs reconciliation with later return items and their payment or mandate links before concluding the customer received funds.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse customer-receipt claims based only on the payout debit; reconcile subsequent refund-return evidence.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Kubernetes blocking strict audit stage
Does any Kubernetes audit-backend failure automatically fail the API operation?
Kubernetes distinguishes batch, blocking and blocking-strict audit modes. The documented blocking-strict request-failure condition applies to audit logging failure at RequestReceived; ordinary blocking waits for event processing, and batch is asynchronous. A configured backend does not establish universal fail-closed behaviour for every audit stage.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not generalise the RequestReceived failure condition to every stage or mode, or infer rollback of an already performed action.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure logexport retry duplicate loss
Does Azure Monitor data export deliver each log record exactly once despite destination outages?
Azure documents export retries for up to 12 hours when the destination lacks capacity or availability. Retries may duplicate some records, and data is discarded if the destination remains unavailable beyond that period. Both missing records and repeated delivery require reconciliation.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer exactly-once or loss-free delivery from an enabled export; retain explicit unknowns where source comparison is unavailable.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure management group export hierarchy gap
Does a root management-group diagnostic setting capture every subscription activity event?
Azure documents that subscription events lacking the hierarchy property do not propagate to management-group diagnostic settings, including the root. Subscription-level settings are needed for those events. Configuring both levels may duplicate shared events, so coverage and deduplication are separate checks.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not claim full subscription coverage from root-group routing alone or remove necessary subscription routing merely to eliminate duplicates.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Google Cloud agent platform transparency component scope
Does platform-level Access Transparency support cover every AI serving component?
The captured Agent Platform guide lists component and workload exclusions, including custom-container inference or explanation, AutoML forecasting resources, RAG Engine, Vector Search 2.0 and Vizier. General support for the platform does not establish coverage of a deployment using an excluded path. Product names and support must be checked against the dated source.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not apply a platform-wide logging claim to an excluded component or infer observed deployment behaviour from this review.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Step functions start version binding
Does starting an unqualified state machine ARN execute the previously reviewed version?
An unqualified ARN starts the latest revision and is not associated with a version, even if a version contains that same revision. A version ARN selects that version; an alias ARN selects through the alias. Approval evidence must bind the invoked ARN and execution version rather than assume that a previously reviewed definition was used.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Documentation does not independently establish the buyer's approval or actual deployed definition.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Step functions callback principal account
Can a principal in another AWS account directly return a Step Functions task token?
The integration guide requires task tokens to be returned by principals in the same AWS account; tokens sent from principals in a different account do not work. Returning a token is a technical callback mechanism, not proof that a reviewer had business authority or that the referenced action matches an approval.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not interpret token possession as business approval or disclose tokens in audit records.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
EventBridge replay order not preserved
Does EventBridge archive replay preserve the original event order?
Archived events are not necessarily replayed in their original arrival order. Replay selection uses event time and processes one-minute intervals; replay metadata identifies the replay. Consumers must reconcile action identities and ordering requirements rather than assume replay reproduces the original execution sequence.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Replay does not validate causality, restore business state atomically or prevent repeated effects.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS CUR seller invoicing entity
Does AWS CUR LegalEntity always identify the party issuing the invoice?
LegalEntity identifies the seller of record for the product or service. The seller and invoicing entity are usually the same but can differ for third-party AWS Marketplace transactions. Bind the invoice issuer, seller and relevant purchase separately; the exported seller label does not authorize a changed payee or bank account.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- A billing label is not merchant authentication or authority to change payment details.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Databricks original record latency boundary
Does Databricks' typical usage availability establish that later corrections are complete?
The captured guide says original billing usage records are typically available within twelve hours, with new workspaces potentially taking longer. This statement applies only to ORIGINAL records, not RETRACTION or RESTATEMENT corrections. It is not a finalization deadline; retain the observation time and reconcile later changes before closing an interval.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Typical availability is neither a delivery SLA nor proof of a final or complete bill.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure cost export partitions replacement
Does one downloaded Azure cost-export file preserve the complete report and its earlier version?
Enhanced exports partition data, with each file containing only a subset and the manifest describing the full set. Daily overwrite is enabled by default and replaces the previous day's file with updated data. Reconstruct a run from its manifest and all partitions, and preserve a dated copy if the earlier report is needed for reconciliation.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- A successful file download does not establish dataset completeness or immutable history.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
GitHub immutable release mutable description
Does an immutable GitHub release freeze its title, notes and latest designation?
GitHub locks an immutable release's assets and associated tag, but its title, release notes, pre-release status and latest designation remain editable. Preserve the actual asset digest and release attestation separately from a captured description. Immutability does not establish that later editorial claims were present when the artifact was approved.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Integrity protection is not code safety certification or approval of mutable description text.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Npm trusted publisher token coexistence
Does adding an npm trusted publisher disable traditional publishing tokens?
Trusted publishing adds an OIDC-authenticated publishing route alongside traditional tokens and manual publishing. Disallowing traditional tokens is a separate package setting; OIDC publishers continue to work when that restriction is applied. Review all enabled routes before describing the package as tokenless.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- A trusted publisher entry does not independently establish that legacy credentials were revoked.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Npm OIDC provenance generation conditions
Does every npm OIDC publication automatically include provenance?
The captured guide limits automatic provenance to supported GitHub Actions or GitLab CI/CD publication from a public repository to a public package. CircleCI provenance is not supported in that capture, and generation can be explicitly disabled. Verify the actual attestation and configuration rather than infer provenance from OIDC authentication alone.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Provenance presence still does not certify absence of malicious code or verify buyer deployment.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
PyPI GitHub owner identity resurrection
Can a new GitHub account reusing a former owner's name inherit its PyPI trusted publishing authority?
PyPI stores the configured GitHub owner's immutable ID and checks repository_owner_id during token minting. A matching reused username with a different owner ID fails that check. Review the stable identity binding; a textual owner or repository name alone is not the documented authority test.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- This protection does not establish the original owner's account security or package-content safety.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
NIST AI RMF intervention responsibility
Does an emergency stop button establish the AI RMF intervention outcome?
AI RMF 1.0 MANAGE 2.4 pairs mechanisms for superseding, disengaging or deactivating unsuitable systems with assigned and understood responsibilities. A control shown in a user interface is not evidence that an authorized operator can apply it in the relevant scenario. Review mechanism scope, responsible roles and evidence of its application separately.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- The source does not establish runtime enforcement, automatic shutdown or effectiveness in a specific deployment.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
NIST AI RMF adjudicated feedback
Does collecting AI user feedback establish that it influences the system?
AI RMF 1.0 GOVERN 5.2 describes mechanisms for regularly incorporating adjudicated feedback into design and implementation. A feedback inbox or survey count does not establish review, disposition or incorporation. Trace relevant feedback to a reasoned decision and the resulting change or documented decision not to change.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- The framework does not require every suggestion to be accepted or prove that feedback represents all affected users.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra emergency use review validation
Does a successful emergency-account sign-in establish that its administrative use was authorized?
Microsoft separates sign-in and audit monitoring, post-use review and periodic validation. Its guidance calls for reviewing whether emergency use was authorized and actions appropriate, and testing sign-in and administrative functionality at least every 90 days and after specified organizational changes. A successful sign-in alone establishes neither business authorization nor continued readiness.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Monitoring and exercises do not certify compliance or establish that every action was observed.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review