{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T02:40:06.177Z",
  "record_id": "VXI-EXT-PROCUREMENT-AWS-ROLE-CUTOFF-01-v1",
  "record_kind": "external_reference",
  "title": "IAM role revocation: Existing sessions and new assumptions differ",
  "system": "AWS IAM",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does revoking active IAM role sessions prevent the role from being assumed again?",
  "near_questions": [
    "What time boundary does role-session revocation use?",
    "Can a caller assume the role again afterwards?",
    "Does revocation remove the trust policy?",
    "Which sessions predate the cutoff?",
    "Are later temporary credentials affected?",
    "What evidence proves old sessions are denied?",
    "Which identities can request a new session?",
    "Does one denied request prove the role is disabled?",
    "How should procurement separate sessions from trust?",
    "Does this procedure cover every role type?",
    "When should an agent refuse a permanent-disablement claim?",
    "Can I save an IAM revocation review?"
  ],
  "supported_claims": [
    {
      "claim": "The documented operation adds a deny policy for temporary credentials issued before a cutoff time. It does not by itself remove the ability to obtain later sessions. Review the trust relationship and assumption permissions separately from invalidating existing sessions.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "The documented operation adds a deny policy for temporary credentials issued before a cutoff time. It does not by itself remove the ability to obtain later sessions. Review the trust relationship and assumption permissions separately from invalidating existing sessions.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-ENTRA-CAE-01-v1",
    "VXI-EXT-PROCUREMENT-WORKSPACE-APP-SCOPES-01-v1",
    "VXI-EXT-PROCUREMENT-GITHUB-APP-IDENTITY-01-v1",
    "VXI-EXT-PROCUREMENT-GITLAB-PAT-ROTATION-01-v1",
    "VXI-EXT-PROCUREMENT-SNOWFLAKE-SECONDARY-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "AWS role session revocation",
    "source_url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-AWS-ROLE-CUTOFF-01-v1",
    "candidate_record_sha256": "4b06df9ea493198bfe4af45c2cb4ceb810904a14257cb7c551d5cb86885359ae",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The documented operation adds a deny policy for temporary credentials issued before a cutoff time. It does not by itself remove the ability to obtain later sessions. Review the trust relationship and assumption permissions separately from invalidating existing sessions.",
    "required_buyer_context": "AWS IAM: Role trust, assumption grants, revocation time and session inventory; buyer configuration and operational evidence are required.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "Revoking sessions permanently disables all access through the role.",
    "documented_statement": {
      "status": "documented",
      "statement": "The documented operation adds a deny policy for temporary credentials issued before a cutoff time. It does not by itself remove the ability to obtain later sessions. Review the trust relationship and assumption permissions separately from invalidating existing sessions.",
      "source_ids": [
        "aws-role-revoke"
      ]
    },
    "buyer_evidence_required": [
      "Revocation cutoff and attached deny policy.",
      "Role trust policy and current assumption permissions.",
      "Evidence covering both old-session denial and new-session issuance."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Do not treat a session cutoff as permanent role disablement."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "aws-role-revoke",
        "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html",
        "final_url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html",
        "title": "AWS role session revocation",
        "checked_on": "2026-10-16",
        "sha256": "a21fc107ecdb5bee2b62ed347e92d4d3670ba66a46a8a1fe5d84b2fc11d79a53",
        "bytes": 22508
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Retain the distinction between cancelling current sessions and closing future access.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Role trust, assumption grants, revocation time and session inventory"
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#aws-role-session-revocation-cutoff",
  "machine_readable_record": "/varexis-index/records/aws-role-session-revocation-cutoff.json"
}