Entra PIM approver identity restrictions
Can an Entra PIM requester or service principal approve the activation request?
For Microsoft Entra role activation, PIM prohibits approvers from approving their own requests and does not allow service principals to approve requests. Delegation to an approver does not remove these identity restrictions.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not represent a requester self-approval or a service-principal approval as a supported PIM role approval.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra PIM ticket reference not validation
Does requiring a PIM ticket number validate the external approval ticket?
The Entra PIM ticket-information setting requires a support ticket reference but treats it as an information-only field. PIM does not enforce correlation with an external ticketing system. A populated reference is therefore not evidence that the ticket exists, is approved, or covers the action.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse external-change-approval claims based solely on the PIM ticket field; independently bind the referenced ticket.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Google Cloud pam delete active grant precondition
Can deleting a PAM entitlement substitute for revoking its active grants?
Google's entitlement-management guide says an entitlement with active grants cannot be deleted; those grants must first be revoked. An attempted entitlement deletion is not evidence that active temporary access was removed.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse completed-access-removal claims based only on an entitlement delete request; reconcile the grants first.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra PIM auth context fallback gaps
Does PIM's authentication-context fallback cover a disabled or report-only Conditional Access policy?
PIM's documented fallback to MFA protects the case where no Conditional Access policy targets the configured context. It is not triggered when a targeting policy is disabled, report-only, or excludes the eligible user. Context configuration therefore cannot substitute for checking the applicable enabled policy.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not claim the intended context controls or fallback were enforced without checking policy state and user applicability.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra PIM default approver lockout
Can requiring PIM approval leave no available default approver?
When no specific approvers are selected, active Privileged Role Administrators or Global Administrators are the defaults. Microsoft warns of tenant lockout when all such administrators are only eligible, none are active, approval is required, and no approvers are selected. An approval requirement alone does not establish an available escalation path.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not assert a usable approval path without an available eligible approver configuration; this review does not authorise bypass.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup multiple hold release
Does releasing one AWS Backup legal hold make a recovery point deletable?
A recovery point can have multiple legal holds. AWS states it cannot be deleted while any hold remains; after all holds are removed its own retention lifecycle applies. Releasing one named hold neither clears other holds nor establishes immediate deletion.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not report deletion eligibility or completion from a single hold release without the complete hold set and lifecycle.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup temporary copy cleanup
Does DELETE_AFTER_COPY mean a temporary recovery point disappears after the first copy finishes?
For the documented temporary snapshot flow, DELETE_AFTER_COPY schedules removal after all copy jobs complete or the specified retention period, whichever comes first. Copy-triggered cleanup requires all automatic and scheduled jobs to finish and a completed air-gapped copy retained at least as long as the source. Failed copying retains the source according to its lifecycle. Continuous-backup temporary snapshots have a separate cleanup rule because the continuous source remains. Identify the backup mode and retention path before inferring removal.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer source removal from one successful copy, assume retention expiry waits for successful protection, or apply snapshot rules to continuous-backup flows. Observed deletion remains separate from a lifecycle policy.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS backup restore selection tag boundary
Do restore-testing tag conditions ensure the restored recovery point carries those tags?
AWS Backup evaluates resource-selection tags using the protected resource's latest recovery point. It then selects at most one eligible recovery point using the plan's time window and latest-or-random rule; the tag conditions do not filter that recovery-point choice. A selected resource can therefore be restored from a point with different tags.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not claim a tagged recovery version was tested without identifying the actual selected point and its attributes.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
DynamoDB deleted table system backup
Does deleting a DynamoDB table with PITR enabled remove every recoverable table copy?
AWS documents that deleting a PITR-enabled table creates a system backup retained for 35 days. It is a snapshot immediately before deletion, supporting recovery to that single point rather than the former continuous timeline. Table deletion therefore does not establish immediate loss of recoverability.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer complete erasure or continued full PITR history from the table deletion; account for the system snapshot and other copies.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure backup operational softdelete exclusions
Does Azure Backup soft delete protect all operational snapshots and log recovery points equally?
Microsoft distinguishes vaulted backups from operational disk and VM snapshots that can be accessed and deleted directly before their soft-delete period expires. The reviewed guide excludes operational blob and Azure Files backups from soft-delete support and excludes SQL Server and SAP HANA log recovery points from recovery-point soft delete. Vault-level settings are not universal copy protection.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse blanket soft-delete protection across all copies without checking these workload and recovery-point exclusions.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Adyen refund remaining balance scope
Can an agent refund the original captured amount without reconciling earlier refunds and chargebacks?
Adyen's refund validation uses the remaining payment balance, and cumulative partial refunds cannot exceed the captured amount. The guide's examples deduct prior refunds or chargebacks from the available balance. The original payment amount alone is insufficient input for a further refund decision.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer remaining refund capacity from the original capture or authorise an amount without current reconciliation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Wise cancelled refunded state distinction
Does Wise cancelled identify the same financial outcome as funds_refunded?
Wise distinguishes funds_refunded from cancelled. The status table describes cancelled as final for an unfunded transfer, but the same documentation also shows a funded returned-payment flow passing through processing and cancelled before funds_refunded, and permits rollback transitions. A cancelled label alone therefore establishes neither absence of funding nor completion of a refund. Reconcile the state timeline, funding and provider refund evidence.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer that cancelled means never funded or already refunded. Reconcile transfer history and refund evidence; a provider status is not independent proof of receipt at the sender bank.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Wise logical transfer retry identity
Should an uncertain Wise transfer creation be retried with a new customerTransactionId?
Wise's error guide identifies customerTransactionId as the logical transfer identifier and says to reuse it when retrying the same uncertain creation. A new identifier can create another transfer. The quote.duplicate error requires reconciliation of the existing transfer rather than reusing that quote for another one.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not create a new logical identifier merely to recover an uncertain response; reconcile the existing transfer first.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
GoCardless confirmed late failure
Does a GoCardless confirmed or paid-out payment prove an irreversible collection?
GoCardless documents late failure when delayed bank reporting corrects a payment previously marked confirmed. Its lifecycle also includes chargebacks returning funds under the applicable Direct Debit rules. A paid-out or confirmed state therefore needs continued outcome reconciliation rather than being treated as irrevocable finality.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer irreversibility, settled revenue or absence of future reversal from a lifecycle snapshot.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
GoCardless payout net components
Does a GoCardless payout amount identify which invoices were paid?
GoCardless payouts net credits and debits, including payments, fees, refunds and chargebacks. The Payout Items API exposes each item's signed amount, type and relevant resource links. The net payout amount alone cannot attribute every included payment or adjustment to an invoice.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not infer invoice-level settlement from a net payout total or count fee and reversal items as new collections.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure logexport start time coverage
Does a new Log Analytics data-export rule include records already stored in the workspace?
Azure Monitor's continuous data-export rules export new table data as it arrives, starting from configuration time. The documentation identifies separate mechanisms for historical export, each with its own availability and limits. Rule creation alone is not a backfill receipt.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not report complete historic evidence from the continuous export rule alone; bind any backfill to its own result and limits.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure logexport failure metric interpretation
Does the Azure Export Failures metric count permanently missing log records?
The documented Export Failures metric counts failed export requests, including throttling, access and server errors. A retry process handles those attempts, so Microsoft explicitly says the metric is not an indication of missing data. Collection-health failures and confirmed record loss must be reported separately.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not relabel failed-attempt counts as lost records or infer zero loss from an unexamined metric.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Google Cloud transparency automation and notice exclusions
Does an empty Access Transparency log rule out all Google access to customer content?
The reviewed exclusion list includes Google's standard automated systems, cases where notification is legally prohibited, access not targeting Customer Data, and specified public identifiers or resource names. Access Transparency is therefore a bounded personnel-access record, not a complete record of every processing operation.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Refuse universal no-access claims from log absence; this review cannot determine whether an excluded event actually occurred.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Step functions start idempotency state
When can a Step Functions StartExecution retry return the original execution?
For Standard workflows, the same name and input return the original response only while the execution is running. A closed execution or different input returns ExecutionAlreadyExists; names can be reused 90 days after closure. Express StartExecution is not idempotent. Retrying safely requires the workflow type, identity, input and current execution state.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- A successful start response does not establish completion of downstream effects.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Step functions sync early callback boundary
Can a Step Functions .sync task finish before its service job completes?
A job can return a task token through SendTaskSuccess or SendTaskFailure before it fully completes. Step Functions uses that response to finish the task, stops monitoring the job and continues the workflow. A task-completion event on this path is therefore not evidence that the service job itself reached completion.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Do not equate callback success with independently verified job completion.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
EventBridge missing bus success response
Can EventBridge return HTTP 200 while dropping an event sent to a nonexistent bus?
AWS documents that publishing with PutEvents to a bus that does not exist can return 200 without counting the event in FailedEntryCount. Matching finds no rule and drops the event. Verify the intended account, region and bus identity rather than treating a successful response and zero failed entries as delivery evidence.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Neither HTTP success nor a zero failure count proves bus existence or target execution.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AWS CUR resource id absence
Does a blank AWS CUR ResourceId mean the cost row is invalid?
Resource IDs are optional in Cost and Usage Reports. Even when enabled, data-transfer and API-request usage and items such as discounts, credits and taxes can have a blank ResourceId. A resource-only filter can therefore exclude legitimate charges or adjustments; assess the line type and reporting configuration before rejecting the row.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- A populated resource ID does not authenticate ownership, and a blank ID is not proof of zero cost.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Databricks usage retraction restatement
How should Databricks billing usage corrections affect a cost total?
Corrections add a negative RETRACTION to cancel the original usage and normally a RESTATEMENT containing corrected fields. If the original should not have existed, there may be only a retraction. Retain record_type and signed quantities across all related rows; ignoring negatives or requiring every correction to have a restatement can leave an incorrect total.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Usage corrections do not establish invoice settlement or independent accuracy of the underlying meter.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Snowflake daily cloud services adjustment
Can Snowflake's cloud-services adjustment be calculated from one monthly percentage?
Snowflake calculates the cloud-services adjustment daily in UTC using ten percent of virtual-warehouse usage. The daily adjustment is capped at actual cloud-services consumption, and serverless compute does not contribute to that threshold. The monthly adjustment sums daily calculations, so applying one percentage to monthly totals can produce a different result.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Credits and adjustment arithmetic are not proof of invoice payment or an enforced spending cap.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Azure reservation recommendation history
Can an Azure reservation recommendation export reconstruct a past purchasing recommendation?
Reservation recommendation exports represent the current snapshot and do not support historical backfill. Historical export support for other datasets must not be generalized to recommendations. To assess what was presented when a commitment was approved, use a retained, dated recommendation and its parameters rather than a current export requested for an earlier period.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- A recommendation does not prove realized savings, historical approval or suitability of a new commitment.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
GitHub immutable release asset completeness
Does GitHub release immutability establish that all required deliverable assets were included?
GitHub recommends creating a draft, attaching all associated assets and then publishing so the asset set is in place before immutability applies. Treat publication as an asset-completeness checkpoint. A signed or immutable release can still omit an operationally required file if the required set was not checked beforehand.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- An integrity attestation does not prove that the chosen asset set satisfies a buyer's requirements.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Npm trusted publisher first use expiry
Can an unused npm trusted-publisher configuration remain ready indefinitely?
A new configuration must complete its first successful publish within two days. That first publish validates it and binds the immutable repository identity. An unused configuration expires after that window and must be deleted and recreated before it can be used. Inspect validation state and date rather than treating the saved connection as operational evidence.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- A configured or validated publisher does not establish package-content safety or future workflow success.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
PyPI pending publisher name reservation
Does a pending PyPI trusted publisher reserve the proposed project name?
A pending publisher neither creates the project nor reserves its name until publication. If another user registers the name first, the pending publisher is invalidated. Confirm actual project ownership and publication outcome before treating the configuration as evidence that the intended distribution identity is secured.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- Pending configuration is not namespace ownership, a package review or a completed release.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
NIST AI RMF safe decommissioning
Does removing an AI service from inventory establish a safely managed retirement?
AI RMF 1.0 GOVERN 1.7 describes processes for safely phasing out AI systems without increasing risk or reducing organizational trustworthiness. Inventory removal alone does not establish that transition. Identify dependencies, outstanding work, retained evidence and accountable transition decisions as buyer-specific review inputs; the source does not prescribe a universal deletion checklist.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- The framework does not prove deletion, prescribe every retirement step or certify a completed exit.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
NIST AI RMF assessor independence
Does a developer-only assessment establish the AI RMF independent-assessment outcome?
AI RMF 1.0 MEASURE 1.3 includes regular assessment involving internal experts who were not front-line developers and/or independent assessors, with relevant consultation as needed. It does not require every review to be external. Retain assessor roles, involvement in development, review scope and findings before making an independence claim.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- An independent review is not certification, complete objectivity or proof that all risks were detected.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Entra emergency conditional access exclusion
Must an Entra emergency-access account be excluded from report-only Conditional Access policies?
The captured guidance distinguishes enforced policies that block or restrict sign-in from report-only policies. It recommends excluding emergency accounts from blocking or restricting policies, while report-only policies do not require that exclusion. Review actual policy state and authorized validation rather than treating all policies as equivalent blockers.
Documentation reviewed 2026-10-29. Primary source.
Boundaries
- The source is planning guidance, not authorization to weaken controls or proof that a particular account can sign in.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review