CS-SEC-002 · SEC Security, privacy, sovereignty and evidence custody · 148 of 192
Apply role and purpose-based permissions
Security Administrator · Trigger: A user requests configuration, payload or recovery access.
Simulated fixture data. Every record, receipt and timeline entry on this screen is demonstration material. It is never production evidence.
Acceptance
1 of 3 steps satisfiedPermission tests will show allowed and denied actions with policy evidence.
Run the remaining steps below. The result is read back from record state — nothing here is a toast.
Normal path
Access is reviewed, excess access is revoked and the credential path is rotated.
Step 1. Complete the periodic access review.
satisfiedOperates onACCE-018R. Mehta (Semantic Steward) → HAL Document library A7Access record· OPTIMON-IND / Nagda Warehouse
stategrantedreviewacceptedretentionheld
Separation of duties: Integration Engineer may not do this. Act as
Acceptance for this step: review = accepted
Step 2. Revoke access that is no longer justified; record the offboarding receipt.
not yet satisfiedOperates onACCE-025A. Kulkarni (Integration Engineer) → RGH OT controller C21Access record· OPTIMON-IND / Raigarh Melt Shop
stategrantedreviewacceptedretentioncurrent
Separation of duties: Integration Engineer may not do this. Act as
Acceptance for this step: state = revoked
Step 3. Rotate the credential reference exposed by that access.
not yet satisfiedOperates onCONN-004SHF Event stream D4 — least-privilege connectionConnection· NORTHBRIDGE-ALLOY / Sheffield Bar Mill
reachabilitythrottledcredentialpendingcontainmentstable
Separation of duties: Integration Engineer may not do this. Act as
Acceptance for this step: credential = current
Exception path
Visibility of a connection will not automatically grant access to raw payloads or credentials.
Alternate path. An investigation is open: apply a legal hold instead of deleting anything.
satisfiedOperates onACCE-018R. Mehta (Semantic Steward) → HAL Document library A7Access record· OPTIMON-IND / Nagda Warehouse
stategrantedreviewacceptedretentionheld
Separation of duties: Integration Engineer may not do this. Act as
Acceptance for this step: retention = held
Workflow as specified
CoreSync will evaluate the declared role, purpose, source scope and sensitive operation, separating view, edit, approve, deploy and replay privileges.
Evidence written in this session
Nothing run yet in this session. Record state shown above may already satisfy steps from the seeded fixture history.
Journeys that include it
Not part of a composite journey; exercised through its family views.