What the scenario describes
Authored example — not collected evidenceWhat remains unknown
- Actual permissions and access reach
- Whether tokens remain valid
- Vendor handling and downstream copies
SAFEGUARD COMPARISON
What changes if these controls exist?
Toggle proposed controls. This changes the illustration, never a real system or finding.
Rule DC-PATH-01 v1: all three absent → immediate review; some absent → review required. No probability or security score is claimed.
Recommended management decision
- Suggested owner
- Before change
- Customer IT approval, maintenance window and recorded rollback plan.
- Before closure
- Fresh configuration evidence and an independent retest. This demo cannot close real findings.
How a real engagement would work
Written authority → client-operated evidence collection → pathway review → agreed change plan → IT implementation → independent retest. Employee activity and personal accounts are excluded from this demonstration.
Production access controls, evidence storage, audit history and security review are still required. The service and prices have not been validated with customers.