Access-rule evidence report
invoice-three-paths
Fail
At least one approved expectation was demonstrably violated.
16
Passed
2
Failed
0
Blocked
0
Not assessed
What was checked
- Observed
- 2026-11-05 06:38:23 UTC
- Approved rule
- revision 1
sha256:87ed888660b38257523dc96f7d6ccb5a4cdee17655f5fc19db5a9d48562dc765 - Approval
- local-self-attested
- Target
- http://127.0.0.1:54321
- Environment
- local-disposable
- Request paths
- /rest/v1/invoices
/rest/v1/rpc/get_invoice
http://127.0.0.1:8787/api/invoices/{id} - Source
- 6704db4781aa99bd88ca2f597e883df6d62841ea
uncommitted changes present - Completeness
- complete
- Freshness
- unknown (no dependency observer)
Access review
2 access changes since the previous run
| Change | Who | Request path |
|---|---|---|
| Gained access | user-a can now read invoice-b | app-invoice-route |
| Gained access | user-b can now read invoice-a | app-invoice-route |
Proof matrix
Who may read which record
app-invoice-route http · http://127.0.0.1:8787/api/invoices/{id}
2 disclosedinvoice-a
invoice-b
user-asigned-in user
Must read own record
Pass
Must not see record
Fail
user-bsigned-in user
Must not see record
Fail
Must read own record
Pass
anonymousno session
Must not see record
Pass
Must not see record
Pass
data-api data-api · /rest/v1/invoices
invoice-a
invoice-b
user-asigned-in user
Must read own record
Pass
Must not see record
Pass
user-bsigned-in user
Must not see record
Pass
Must read own record
Pass
anonymousno session
Must not see record
Pass
Must not see record
Pass
rpc-get-invoice rpc · /rest/v1/rpc/get_invoice
invoice-a
invoice-b
user-asigned-in user
Must read own record
Pass
Must not see record
Pass
user-bsigned-in user
Must not see record
Pass
Must read own record
Pass
anonymousno session
Must not see record
Pass
Must not see record
Pass
Assertions
Each expectation, what was observed, and what to do
| Status | Assertion | Expectation | Finding |
|---|---|---|---|
| Pass | a-reads-a data-api · user-a → invoice-a | Must read own record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | b-reads-b data-api · user-b → invoice-b | Must read own record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | a-reads-b data-api · user-a → invoice-b | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | b-reads-a data-api · user-b → invoice-a | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | anon-reads-a data-api · anonymous → invoice-a | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | anon-reads-b data-api · anonymous → invoice-b | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | a-reads-a rpc-get-invoice · user-a → invoice-a | Must read own record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | b-reads-b rpc-get-invoice · user-b → invoice-b | Must read own record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | a-reads-b rpc-get-invoice · user-a → invoice-b | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | b-reads-a rpc-get-invoice · user-b → invoice-a | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | anon-reads-a rpc-get-invoice · anonymous → invoice-a | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | anon-reads-b rpc-get-invoice · anonymous → invoice-b | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | a-reads-a app-invoice-route · user-a → invoice-a | Must read own record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Pass | b-reads-b app-invoice-route · user-b → invoice-b | Must read own record | Observed exactly what the approved rule expects. ok · HTTP 200 |
| Fail | a-reads-b app-invoice-route · user-a → invoice-b | Must not see record | A user who must not see this record received it. This is a real access-control regression for this route. Next: Review recent changes to RLS policies, grants, views and security-definer functions on this table. Fix the policy, then re-run. fixture_disclosed · HTTP 200 |
| Fail | b-reads-a app-invoice-route · user-b → invoice-a | Must not see record | A user who must not see this record received it. This is a real access-control regression for this route. Next: Review recent changes to RLS policies, grants, views and security-definer functions on this table. Fix the policy, then re-run. fixture_disclosed · HTTP 200 |
| Pass | anon-reads-a app-invoice-route · anonymous → invoice-a | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 401 |
| Pass | anon-reads-b app-invoice-route · anonymous → invoice-b | Must not see record | Observed exactly what the approved rule expects. ok · HTTP 401 |
Controls
Preconditions established before any result was trusted
| State | Control | Detail |
|---|---|---|
| Established | baseline | OK |
| Established | target | OK |
| Established | api-key | OK |
| Established | setup-key | OK |
| Established | fixture:invoice-a | OK |
| Established | fixture:invoice-b | OK |
| Established | identity:user-a | OK |
| Established | identity:user-b | OK |
| Established | actors-distinct | OK |
| Established | identity:anonymous | OK |
| Established | fixtures-stable | OK |
Run history
2 runs in this report
| Observed | Outcome | Approved rule | Commit | Assertions |
|---|---|---|---|---|
| 2026-11-05 06:38:23 UTC | Pass | r1 · sha256:87ed888660b3 | 6704db4781 (modified) | 18/18 passed |
| 2026-11-05 06:38:23 UTC | Fail | r1 · sha256:87ed888660b3 | 6704db4781 (modified) | 16/18 passed |
Scope and limits
This report covers only the assertions listed above, against synthetic records, on the named target, at the observed time. It is not a security certification, a penetration test, or evidence about production or any other access path.
The approved rule was acknowledged locally (self-attested): anyone with write access to the approval store could change it. Results are produced on infrastructure controlled by whoever ran the check; provenance identifies the producer, not honest execution. Execution context declared: ci-development.