{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-29T21:43:00.943093Z",
  "record_id": "VXI-EXT-ICE06-GCP-PAM-POLICY-CAPACITY-GRANT-FAILURE-01-v1",
  "record_kind": "external_reference",
  "title": "Google Cloud pam policy capacity grant failure",
  "system": "Google Cloud",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a PAM entitlement guarantee that a new temporary grant can be applied?",
  "near_questions": [
    "PAM grant IAM policy size limit",
    "temporary privilege request fails policy capacity",
    "entitlement exists but grant failed",
    "Google PAM active grant binding space"
  ],
  "supported_claims": [
    {
      "claim": "PAM adds time-bound IAM role bindings, and each active grant consumes IAM policy space. Google documents that new grant requests fail when the resource policy reaches its size limit. Entitlement configuration alone does not prove that a requested elevation was successfully installed.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Refuse active-authority claims without successful grant state and applicable policy evidence; do not infer success from entitlement existence.",
    "Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.",
    "No expanded capabilities or licences for existing INDEX executables."
  ],
  "public_summary": "PAM adds time-bound IAM role bindings, and each active grant consumes IAM policy space. Google documents that new grant requests fail when the resource policy reaches its size limit. Entitlement configuration alone does not prove that a requested elevation was successfully installed.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Google Cloud: PAM best practices",
    "source_url": "https://docs.cloud.google.com/iam/docs/pam-best-practices",
    "checked_on": "2026-10-29",
    "candidate_record_id": "VXI-EXT-ICE06-GCP-PAM-POLICY-CAPACITY-GRANT-FAILURE-01-v1",
    "candidate_record_sha256": "ed8a4bd2d58c8bc0b3d83804329ae9f9fb812b72d10f40f159d3d85456efd788",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "PAM adds time-bound IAM role bindings, and each active grant consumes IAM policy space. Google documents that new grant requests fail when the resource policy reaches its size limit. Entitlement configuration alone does not prove that a requested elevation was successfully installed.",
    "required_buyer_context": "resource policy size and current bindings; grant request and outcome; active grant inventory. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-29",
    "claim_to_check": "Does a PAM entitlement guarantee that a new temporary grant can be applied?",
    "documented_statement": {
      "status": "documented",
      "statement": "PAM adds time-bound IAM role bindings, and each active grant consumes IAM policy space. Google documents that new grant requests fail when the resource policy reaches its size limit. Entitlement configuration alone does not prove that a requested elevation was successfully installed.",
      "source_ids": [
        "pam-practices"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "An incident workflow depends on just-in-time elevation on a heavily used resource. A validly configured escalation can fail when needed. Adds a documented grant-capacity failure mode rather than policy-version preservation. This is an operational review inference, not an observed deployment outcome.",
      "source_ids": [
        "pam-practices"
      ]
    },
    "buyer_evidence_required": [
      "resource policy size and current bindings",
      "grant request and outcome",
      "active grant inventory"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Refuse active-authority claims without successful grant state and applicable policy evidence; do not infer success from entitlement existence."
    },
    "unknowns": "The buyer implementation, effective authority, source-data completeness and actual business outcomes were not inspected.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "No buyer deployment or transaction was observed."
    },
    "evidence_sources": [
      {
        "source_id": "pam-practices",
        "url": "https://docs.cloud.google.com/iam/docs/pam-best-practices",
        "final_url": "https://docs.cloud.google.com/iam/docs/pam-best-practices",
        "captured_at_utc": "2026-10-29T19:03:37.285294+00:00",
        "status": 200,
        "content_type": "text/html; charset=utf-8",
        "bytes": 176261,
        "sha256": "3f6fcc5956246130dfbd1b7c58ba7024b6affac84c0667a4bc4972be3529b5bc",
        "publisher": "Google Cloud",
        "version_context": "Rolling official documentation; applicability is limited to the exact captured response and its stated service, API and feature constraints. Recheck present support before current reliance. Source captured 2026-10-29T19:03:37.285294+00:00.",
        "rights_review": "Public original factual paraphrase and attributed source metadata only. Captured documentation bodies, code examples, images and vendor marks remain private. No vendor software licence, certification or buyer deployment assurance is granted.",
        "capture_integrity_verified": true,
        "source_assertion_reviewed": true,
        "title": "Google Cloud: PAM best practices",
        "checked_on": "2026-10-29",
        "capture_status": 200,
        "claim_review_completed": true,
        "hash_basis": "SHA-256 of captured HTTP response body bytes",
        "reviewed_sections": [
          "IAM policy size limits"
        ]
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Documentation supports only the stated boundary. Existing licensed checkers analyse supported supplied declarations locally; they do not inspect provider accounts, verify live behaviour, enforce decisions or certify compliance.",
    "paid_value": {
      "decision_context": "An incident workflow depends on just-in-time elevation on a heavily used resource. A validly configured escalation can fail when needed.",
      "free": "Complete source review, questions, provenance and limitations; free to read and save locally.",
      "single_request": "Unavailable for this publication-only record; historical saved retrieval is unchanged.",
      "evidence_receipt": "Unavailable for this publication-only record; no paid retrieval entitlement is added.",
      "excluded": [
        "Fresh source research",
        "Native provider integration or schema support",
        "Live inspection or runtime enforcement",
        "Payment settlement or verified deletion",
        "Certification or expanded licences"
      ],
      "integrity": "Hashes identify content versions; they do not prove factual truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck current primary documentation and the applicable API, service, account and configuration before reliance. No ongoing monitoring is included.",
      "specific_watch": "IAM policy size limits"
    },
    "buyer_relevance": "An incident workflow depends on just-in-time elevation on a heavily used resource. A validly configured escalation can fail when needed.",
    "refusal_conditions": [
      "Refuse active-authority claims without successful grant state and applicable policy evidence; do not infer success from entitlement existence.",
      "Do not infer deployment conformance, authority or successful outcomes from source documentation."
    ],
    "decision_context": {
      "operator": "Identity and privileged-access operator",
      "scenario": "An incident workflow depends on just-in-time elevation on a heavily used resource.",
      "consequence": "A validly configured escalation can fail when needed.",
      "confidence": "Primary documentation assertion supported; deployment applicability unverified"
    },
    "novelty_review": {
      "candidate_id": "ICE06-4A22E2309911",
      "disposition": "EXTENSION",
      "nearest_record_id": "VXI-EXT-PROCUREMENT-GCP-CONDITION-LOSS-POLICY-WRITE-01-v1",
      "nearest_record_url": "/varexis-index/records/gcp-iam-policy-version-etag-condition-loss.json",
      "nearest_record_sha256": "0dd62e9ffe5f7bf2da05714612aaf5f90c9219937c1a494f91a12f53593a2fc2",
      "material_distinction": "Adds a documented grant-capacity failure mode rather than policy-version preservation.",
      "independent_challenge": "PASS"
    },
    "optional_selection": {
      "guide_id": "agent-authority-tool-trust",
      "guide_url": "/index-guides/agent-authority-tool-trust",
      "guide_manifest": "/varexis-index/decision-guides.json",
      "checker": {
        "product_id": "agent-tool-admission",
        "price_gbp_excluding_vat": 49,
        "purchase_url": "/index-access?route=agentic_pack_tool_admission_v1",
        "licence_scope": "Existing separate internal-use licence; subscriptions do not include the executable.",
        "benefit": "Optional local analysis of supported supplied declarations only; no native provider integration or verification is added."
      },
      "boundary": "Optional adjacent workflow only. This review does not extend a checker input schema or implement native provider validation. Preserve the six canonical guides unchanged."
    },
    "exact_access": {
      "endpoint": "/mcp/catalogue",
      "tool": "get_publication_record",
      "arguments": {
        "record_id": "VXI-EXT-ICE06-GCP-PAM-POLICY-CAPACITY-GRANT-FAILURE-01-v1"
      },
      "record_url": "/varexis-index/records/gcp-pam-policy-capacity-grant-failure.json",
      "original_mcp_search": false,
      "paid_saved_retrieval": false
    }
  },
  "niche": {
    "niche_id": "ice06-identity",
    "label": "Agent Identity, Credentials & Delegation",
    "classification_id": "identity",
    "classification_label": "Agent Identity, Credentials & Delegation",
    "topic_id": "identity",
    "buyer_intent": "An incident workflow depends on just-in-time elevation on a heavily used resource. A validly configured escalation can fail when needed.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#gcp-pam-policy-capacity-grant-failure",
  "machine_readable_record": "/varexis-index/records/gcp-pam-policy-capacity-grant-failure.json"
}