CS-CON-001 · CON Secure connectivity and source protection · 9 of 192
Establish a least-privilege connection
Integration Engineer · Trigger: A source connection is configured.
Simulated fixture data. Every record, receipt and timeline entry on this screen is demonstration material. It is never production evidence.
Acceptance
2 of 3 steps satisfiedA successful permitted read and a denied out-of-scope operation will both appear in the test evidence.
Run the remaining steps below. The result is read back from record state — nothing here is a toast.
Normal path
Connectivity is proven in stages and the credential reference is current — without the secret ever being shown.
Step 1. Run the staged access test: network, authentication, then bounded read.
satisfiedOperates onCONN-022NGD Historian D22 — least-privilege connectionConnection· OPTIMON-IND / Nagda Warehouse
reachabilityreachablecredentialcurrentcontainmentstable
Moves the record and writes evidence. Permission: test.
Acceptance for this step: reachability = reachable
Step 2. Rotate the credential reference held for the connection.
satisfiedOperates onCONN-001RGH OT controller A1 — least-privilege connectionConnection· OPTIMON-IND / Raigarh Melt Shop
reachabilityreachablecredentialcurrentcontainmentstable
Separation of duties: Integration Engineer may not do this. Act as
Acceptance for this step: credential = current
Step 3. Record the access review covering the principal that holds the credential.
not yet satisfiedOperates onACCE-008J. Okonkwo (Quality Data Steward) → HAL Relational database C15Access record· NORTHBRIDGE-ALLOY / Sheffield Bar Mill
stateexpiredreviewreviewretentionarchived
Separation of duties: Integration Engineer may not do this. Act as
Acceptance for this step: review = accepted
Exception path
A connection with broader rights than policy permits will fail admission or require approved remediation.
Alternate path. Repeated failures: contain the connection so the source is protected.
not yet satisfiedOperates onCONN-022NGD Historian D22 — least-privilege connectionConnection· OPTIMON-IND / Nagda Warehouse
reachabilityreachablecredentialcurrentcontainmentstable
Moves the record and writes evidence. Permission: remediate.
Acceptance for this step: containment = contained, reachability = unreachable
Workflow as specified
CoreSync will request only the declared operations and bind the connection to a runtime identity, scope and policy. Read and state-changing rights will be separately represented.
Evidence written in this session
Nothing run yet in this session. Record state shown above may already satisfy steps from the seeded fixture history.
Journeys that include it
Not part of a composite journey; exercised through its family views.