IAM notprincipal boundary denial
Can a NotPrincipal Deny reject an IAM role despite an intended exclusion?
AWS warns that a resource policy using NotPrincipal with Deny always denies IAM principals with permissions boundaries, regardless of the NotPrincipal values. It recommends a PrincipalArn condition approach instead. An exclusion in that policy form is therefore insufficient evidence that a bounded role can still use the resource.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse an access-preservation claim based only on a NotPrincipal exclusion when the principal has a boundary; effective access remains untested.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra PIM request expiry resubmission
Can an unapproved Entra PIM request remain valid indefinitely?
Delegated approvers have a non-configurable 24-hour window for an Entra role activation request. If it is not approved within that period, the eligible user must submit a new request. A stale pending request is not a continuing approval opportunity.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not bind a later action to an expired approval request without the new request and its decision.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Google Cloud pam edit grant version boundary
Does editing a PAM entitlement update existing grants and all pending approvals uniformly?
Google documents that updated entitlement configuration applies to grants requested after the update. Changes to an approver list also affect undecided requests. Adding or removing approval levels, or changing required approval counts, requires no grants awaiting approval. The reviewed documentation marks these structural controls as preview; multi-level or multiple-approval workflows also require Security Command Center Premium or Enterprise. Bind the request time, decision state and precise type of change to the governing configuration.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not apply all configuration changes retrospectively, treat approver-list changes as approval-level or count changes, or assume preview controls are available in every tier.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Google Cloud pam policy capacity grant failure
Does a PAM entitlement guarantee that a new temporary grant can be applied?
PAM adds time-bound IAM role bindings, and each active grant consumes IAM policy space. Google documents that new grant requests fail when the resource policy reaches its size limit. Entitlement configuration alone does not prove that a requested elevation was successfully installed.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse active-authority claims without successful grant state and applicable policy evidence; do not infer success from entitlement existence.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra PIM active assignment MFA actor
Does MFA on creation of an active PIM assignment prove the assignee authenticated for later use?
The active-assignment MFA setting requires the administrator creating the assignment to satisfy MFA. Microsoft states that PIM cannot enforce MFA when the assigned user uses that already-active role. Assignment-creation authentication and assignee-use authentication are different evidence.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not attribute the assigning administrator's MFA to the assignee or infer later-use MFA from this setting.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup lock retention independent
Does a new Vault Lock minimum replace the lifecycle already assigned to each backup?
AWS describes backup retention periods as defined when each backup is created and independent of the vault lock's minimum and maximum settings. A lock configuration is therefore not evidence that every retained recovery point has the newly selected retention duration.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse a uniform-retention claim based only on the current vault lock; inspect recovery-point lifecycles.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup primary airgap fallback
Does a completed primary-backup job prove the recovery point reached its logically air-gapped target?
For documented unsupported resources or encryption-key cases, AWS Backup can complete to the standard vault with issues while the air-gapped copy is unavailable. For copied resource types, the destination copy job must be reconciled separately with the source recovery point and target vault. Backup completion alone does not establish that protection location.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse air-gapped-copy coverage based only on backup completion; verify the supported path and completed destination copy.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup restore test cleanup status
Does a completed AWS Backup restore test establish that its temporary resource was deleted?
Restore-test deletion has a separate Successful, Deleting or Failed status. AWS documents that failed cleanup needs manual removal and that removing the awsbackup-restore-test tag often causes this failure. Test execution or validation completion alone does not close the retained-resource inventory.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse cleanup completion while deletion is pending or failed; a successful restore is not a deletion receipt.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup restore tag api default
Does an API-driven AWS Backup restore preserve the same tags as the console default?
StartRestoreJob defaults CopySourceTagsToRestoredResource to false, while the documented console default includes tags. Resource-specific exceptions apply: some resources do not support the option, and documented snapshot behaviours can copy tags independently of it. Tag-derived governance cannot be assumed from an otherwise successful restore.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Verify the actual restored tag set and resource-specific rules; do not infer policy restoration from the console default or this Boolean alone.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure backup softdelete rollout api scope
Does an Azure Backup delete operation have the same retention effect in every region and API version?
Microsoft's reviewed secure-by-default guidance distinguishes preview-region behaviour from GA Recovery Services vault enforcement. Preview behaviour depends on client/API versions and prior configuration, while GA enforcement spans API versions. Soft-deleted data remains recoverable for the configured period. The region, vault type, rollout stage and request version are necessary to interpret a delete result.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not apply one rollout's behaviour globally or equate a delete response with permanent deletion. Recheck the current regional matrix before reliance.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Adyen payout booked credit evidence
Does an Adyen payout booked event establish credit to the beneficiary bank?
Booked means the funds were deducted from the balance account and is not final. Adyen distinguishes later failures or returns, local-payout arrival estimates, and credited tracking for completed instant payouts. An estimate or outgoing debit does not establish the same outcome as a credit-confirmation event.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse beneficiary-credit claims from booked or estimatedArrivalTime alone; apply the evidence available for that payout rail.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Wise funding initiation versus receipt
Does a Wise transfer in incoming_payment_initiated establish received funding?
Wise describes incoming_payment_initiated as funding started but not yet received. The processing state indicates Wise has received funds and is performing its processing activities; it does not itself establish payout. Transfer submission, funding receipt and recipient outcome require distinct evidence.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse funded or recipient-paid claims based on a submitted or initiated transfer; do not interpret processing as completed payout.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Wise quote rate expiry distinction
Does an unexpired Wise quote guarantee the originally approved rate remains locked?
Wise exposes rateType, rateExpirationTime and expirationTime as separate fields: rate expiry concerns the locked rate, while expirationTime concerns the whole quote. The guide also binds the rate promise after transfer creation to funding before its deadline. Quote validity alone is not evidence that approved conversion terms still apply.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse unchanged-rate claims without the applicable lock and funding evidence; a replacement quote requires comparison with approved terms.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Wise originator reference restriction
Can changing an originator reference safely resolve Wise's originator-not-allowed error?
For validation.failure.originator.externalId.not.allowed, Wise instructs integrations to investigate the restriction or a confirmed data defect and retain the same reference for the same originator. Altering the identifier is not documented as a legitimate way to clear the restriction.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse a retry that changes identity merely to evade the restriction; this evidence grants no authority to transact.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
GoCardless submitted cancellation boundary
Can a GoCardless payment still be cancelled after submission to the banking system?
GoCardless distinguishes pending submission, where cancellation is available, from submitted, where it says the payment can no longer be cancelled through that flow. The guide directs a customer seeking cancellation at that point to their bank. A local cancellation request is not evidence that the banking instruction stopped.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse completed cancellation from a local request after submission; do not infer a refund or bank stop from this documentation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
GitHub audit stream start time coverage
Does enabling GitHub audit streaming backfill all earlier enterprise events?
GitHub documents that the stream exports audit and Git events for activity from the time streaming is enabled onwards. Existing searchable retention and newly enabled streaming are different coverage windows; historic export needs its own method and receipt.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse historic completeness from a newly enabled stream without a separately reconciled backfill.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure logexport unsupported table success
Does successful creation of an Azure data-export rule prove every selected table is exported?
Azure says a rule containing an unsupported table can be configured successfully while exporting no data for that table. Its support list also contains tables with only certain ingestion paths supported. Configuration success must be reconciled against each table and ingestion source.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse all-table export coverage based only on rule creation or generic table presence.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Google Cloud transparency customer IAM access exclusion
Does Access Transparency contain Google personnel activity authorised by the customer's own IAM policy?
Google excludes personnel access that the customer granted through IAM from Access Transparency and directs that activity to Cloud Audit Logs when enabled. Provider support-access reporting and customer-granted access therefore require different evidence paths.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not conclude no provider-personnel access from Access Transparency alone when customer IAM grants exist.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
SQS dead letter retention clock
Does moving a message to an SQS dead-letter queue restart its retention clock?
For standard queues the original enqueue timestamp continues to govern expiry, while the dead-letter age metric measures time since the move. FIFO queues reset the enqueue timestamp when a message moves to the dead-letter queue. Queue type and original age therefore determine the remaining recovery window.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer remaining recovery time from the dead-letter age metric alone.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Step functions sync cancellation best effort
Does stopping a Step Functions workflow guarantee its synchronous service job stopped?
Cancellation of an aborted .sync integration is best effort. Missing execution-role permissions or a temporary service outage can prevent cancellation, including after the workflow stops or another parallel branch fails. The integrated job may continue and incur charges; reconcile its own status before treating the action as stopped.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Workflow termination does not prove downstream termination or undo completed effects.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
EventBridge PutEvents partial entry result
Does an EventBridge PutEvents response establish that every entry was accepted?
A PutEvents batch can contain both successful entries with EventId and failed entries with ErrorCode and ErrorMessage. Reconcile each response entry with its corresponding request entry and retry only unresolved failures with application-level duplicate controls. Batch-level transport success is not a complete per-event outcome or downstream delivery receipt.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Accepted entries do not establish target delivery or business completion.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
EventBridge archive freshness coverage
Can an immediate EventBridge archive count prove all recent events are available for replay?
Archive ingestion can lag receipt on the bus. AWS recommends delaying replay for ten minutes; DescribeArchive EventCount and SizeBytes can take 24 hours to reconcile new or expired events. These values and the recommended delay are not independent proof of complete capture; reconcile required event identities and the replay window.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not treat an archive count or recommended wait as a completeness guarantee.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS Savings Plan negation grouping
Must every SavingsPlanCoveredUsage row match exactly one SavingsPlanNegation row?
SavingsPlanCoveredUsage unblended cost represents what usage would have cost without the benefit and is offset by negation entries. Negations are grouped hourly by SavingsPlanARN, operation, usage type and Availability Zone, so one can offset several covered rows. Use the documented grouping and SavingsPlanEffectiveCost for the intended calculation rather than summing counterfactual charges as new payable cost.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Report arithmetic does not establish final invoicing, payment or realized savings for an unobserved deployment.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Databricks shared SKU origin attribution
Can a Databricks SKU uniquely identify which product generated usage?
Several Databricks products can share a SKU. The guide identifies billing_origin_product and product_features as the fields for distinguishing the originating product and features, including shared serverless-jobs billing. SKU-only allocation can merge different workloads; preserve the applicable product fields and their documented population conditions.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Billing attribution fields do not independently establish the human requester or purchasing authority.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure cost export missing attributes
Should Azure cost rows with missing subscription attributes be rejected as malformed?
The enhanced export experience uses null or empty values for missing attributes such as subscription IDs instead of a default empty GUID. The guide identifies unused reservations, unused savings plans and rounding adjustments as affected charges. Preserve their applicable billing context rather than silently discarding them or interpreting the placeholder change as a new subscription.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Missing attribution does not mean zero charge or establish which team authorized the cost.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
GitHub immutable release tag reuse
Can deleting an immutable GitHub release restore reuse of its tag name?
After the immutable release is deleted its tag may be deleted, but the same tag name cannot be reused. GitHub also retains protection against reusing tags from an immutable release when a repository is deleted and recreated with the same name. Deletion is therefore not a route to replacing a previously sealed release under its old tag.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- This does not establish continued artifact availability after release deletion or software suitability.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Npm trusted publisher action scope
Does npm trusted publishing grant direct publication and dist-tag management together?
The captured guide distinguishes staged publishing, direct npm publish and dist-tag management. Direct publishing and dist-tag permissions are independent choices, and historical configurations have date-dependent defaults. Review the actual connection's allowed actions. Other stage actions, including approval, require interactive authentication and cannot use OIDC tokens.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Token authentication or npm whoami is not proof of permission for every publishing command.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Npm calling workflow identity check
Which workflow identity must match npm trusted publishing when one workflow calls another?
For the workflow invocation paths described in the captured guide, validation checks the calling workflow name rather than the workflow containing npm publish. The guide also requires id-token: write on parent and child workflows. Match the documented identity to the actual call chain instead of configuring only the reusable publish file.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- This authentication mapping does not verify every action or dependency inside either workflow.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
NIST AI RMF third party contingency
Does recording a third-party AI dependency satisfy the AI RMF contingency outcome?
AI RMF 1.0 GOVERN 6.2 describes contingency processes for failures or incidents involving high-risk third-party AI systems or data. A dependency inventory alone does not show such a process exists. For a buyer review, identify the affected dependency, failure conditions, responsible operator and documented fallback or escalation evidence.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- The framework is voluntary guidance, not certification or proof that a supplier will recover successfully.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
NIST AI RMF residual risk downstream
Can a risk review close without recording remaining risks to downstream users?
AI RMF 1.0 MANAGE 1.4 describes documenting negative residual risks for downstream acquirers and end users. A list of mitigations does not by itself record what remains unmitigated or who may be affected. Review the residual-risk statement, affected uses and decision owner without treating risk documentation as acceptance by every downstream party.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Documented residual risk is not proof of safety, informed consent, legal compliance or transfer of responsibility.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra emergency identity dependency
Can an eligible federated administrator be treated as a fully independent emergency-access path?
Microsoft's emergency-access guidance recommends cloud-only accounts independent of federation and synchronization, with permanent active Global Administrator assignments rather than PIM eligibility. It also separates emergency authentication methods from normal administrator methods. These recommendations address shared failure dependencies; configuration and an actual authorized validation are still needed to establish availability.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- This guidance does not authorize creating privileged accounts or guarantee access during an outage.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review