{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T20:21:57.226Z",
  "record_id": "VXI-EXT-PROCUREMENT-CIRCLECI-CONTEXT-RESTRICTION-01-v1",
  "record_kind": "external_reference",
  "title": "CircleCI contexts: Group, project and expression restrictions combine",
  "system": "CircleCI",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does adding a group restriction prove a CI secret is limited to the intended project?",
  "near_questions": [
    "Does a CI context group restrict which projects can use secrets?",
    "What happens when a CircleCI context has no project restriction?",
    "Do group and expression checks combine as alternatives?",
    "Can multiple allowed groups broaden access?",
    "Which integration supports context security groups?",
    "Does changing group membership take effect immediately?",
    "Can administrators access restricted contexts?",
    "Which pipeline conditions can restrict secret availability?",
    "What evidence identifies the actual trigger path?",
    "Can a context name prove production-only use?",
    "When should a CI secret-scope claim remain qualified?",
    "Can I save a context-restriction review?"
  ],
  "supported_claims": [
    {
      "claim": "CircleCI treats group, project and expression restrictions as separate checks. With no project restriction, the documentation allows use across projects in the organisation; defaults and integration support also matter. Review the complete context configuration and trigger path rather than treating group membership as a project allowlist.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "CircleCI treats group, project and expression restrictions as separate checks. With no project restriction, the documentation allows use across projects in the organisation; defaults and integration support also matter. Review the complete context configuration and trigger path rather than treating group membership as a project allowlist.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-KUBERNETES-SECRET-LIST-01-v1",
    "VXI-EXT-PROCUREMENT-IAM-BOUNDARY-GRANTS-01-v1",
    "VXI-EXT-PROCUREMENT-AZURE-LOCK-PLANE-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "CircleCI context restriction scope",
    "source_url": "https://circleci.com/docs/guides/security/contexts/",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-CIRCLECI-CONTEXT-RESTRICTION-01-v1",
    "candidate_record_sha256": "934ff71193393c0f7d7de97facb91e9bf40fc48d7dadd58297a7228722a8b824",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "CircleCI treats group, project and expression restrictions as separate checks. With no project restriction, the documentation allows use across projects in the organisation; defaults and integration support also matter. Review the complete context configuration and trigger path rather than treating group membership as a project allowlist.",
    "required_buyer_context": "Organisation/integration type, context groups, project restrictions, expressions and trigger.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "The context group setting confines the secret to one approved project.",
    "documented_statement": {
      "status": "documented",
      "statement": "CircleCI treats group, project and expression restrictions as separate checks. With no project restriction, the documentation allows use across projects in the organisation; defaults and integration support also matter. Review the complete context configuration and trigger path rather than treating group membership as a project allowlist.",
      "source_ids": [
        "circleci-context"
      ]
    },
    "buyer_evidence_required": [
      "Context security groups and explicit project restrictions.",
      "Expression restrictions and supported trigger/integration type.",
      "Effective runtime access, including administrator authority and membership refresh."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Do not infer project confinement from a group setting alone."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "circleci-context",
        "url": "https://circleci.com/docs/guides/security/contexts/",
        "final_url": "https://circleci.com/docs/guides/security/contexts/",
        "title": "CircleCI context restriction scope",
        "checked_on": "2026-10-14",
        "sha256": "7668ff4783596fd8813bcb7738ddb1780bb229f30dc9a66f84c4bcdf46374371",
        "bytes": 392403
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Save which context restrictions and trigger evidence support the approved secret-use scope.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Context settings, group synchronisation and trigger support."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#circleci-context-restriction-combination",
  "machine_readable_record": "/varexis-index/records/circleci-context-restriction-combination.json"
}