CS-CON-002 · CON Secure connectivity and source protection · 10 of 192
Bind secrets without exposing their values
Security Administrator · Trigger: A connector requires authentication material.
Simulated fixture data. Every record, receipt and timeline entry on this screen is demonstration material. It is never production evidence.
Acceptance
2 of 3 steps satisfiedConfiguration exports and error traces will contain references, not secret values.
Run the remaining steps below. The result is read back from record state — nothing here is a toast.
Normal path
Connectivity is proven in stages and the credential reference is current — without the secret ever being shown.
Step 1. Run the staged access test: network, authentication, then bounded read.
not yet satisfiedOperates onCONN-023HAL Application API E23 — least-privilege connectionConnection· OPTIMON-IND / Halol Packaging Line
reachabilityunreachablecredentialexpiredcontainmentcontained
Moves the record and writes evidence. Permission: test.
Acceptance for this step: reachability = reachable
Step 2. Rotate the credential reference held for the connection.
satisfiedOperates onCONN-002NGD Historian B2 — least-privilege connectionConnection· OPTIMON-IND / Nagda Warehouse
reachabilityreachablecredentialcurrentcontainmentstable
Separation of duties: Integration Engineer may not do this. Act as
Acceptance for this step: credential = current
Step 3. Record the access review covering the principal that holds the credential.
satisfiedOperates onACCE-009A. Kulkarni (Integration Engineer) → RGH Document library E17Access record· OPTIMON-IND / Raigarh Melt Shop
stategrantedreviewacceptedretentioncurrent
Separation of duties: Integration Engineer may not do this. Act as
Acceptance for this step: review = accepted
Exception path
Missing or inaccessible secret versions will prevent connection without leaking diagnostic material.
Alternate path. Repeated failures: contain the connection so the source is protected.
satisfiedOperates onCONN-023HAL Application API E23 — least-privilege connectionConnection· OPTIMON-IND / Halol Packaging Line
reachabilityunreachablecredentialexpiredcontainmentcontained
Moves the record and writes evidence. Permission: remediate.
Acceptance for this step: containment = contained, reachability = unreachable
Workflow as specified
CoreSync will store an opaque secret reference and resolve material only within the authorized runtime, keeping previews, exports and diagnostics free of credentials.
Evidence written in this session
Nothing run yet in this session. Record state shown above may already satisfy steps from the seeded fixture history.
Journeys that include it
Not part of a composite journey; exercised through its family views.