TENANT_LIFECYCLE
REFERENCE TESTED
Tenant creation, suspension, isolation and termination are explicit and fail closed.
Evidence ceiling E3Proof boundary
INSTITUTIONAL CONTROL MATRIX
Inspect the controls. Challenge the assumptions.
Public Site 80 exposes the Site 77-originated control baseline as historical engineering provenance rather than using customer-ready as an unbounded claim.
Controls
34/34 seller-controlled engineering controls
External effectiveness must still be demonstrated by institution-owned operation and outside evaluation.
TENANT_OBJECT_AUTHORIZATION
REFERENCE TESTED
Every tenant-bound object operation requires object-level tenant authorization.
RBAC_ABAC
REFERENCE TESTED
Role and attribute constraints compose; cross-tenant access is denied.
SEGREGATION_OF_DUTIES
REFERENCE TESTED
High-risk changes support dual authorization by distinct principals.
OIDC_FEDERATION
REFERENCE TESTED
OIDC issuer/audience/key/signature and freshness validation is implemented.
SAML_FEDERATION_CONTRACT
REFERENCE TESTED
SAML metadata, entity, signing and audience requirements are modeled as a bindable institutional contract.
SCIM_2_LIFECYCLE
REFERENCE TESTED
SCIM-style Users/Groups create, read, replace, patch, disable and delete semantics are implemented.
PHISHING_RESISTANT_ADMIN_AUTH
REFERENCE TESTED
Privileged policy requires phishing-resistant MFA or institution-declared equivalent.
SERVICE_CREDENTIALS
REFERENCE TESTED
Service credentials are scoped, expiring, hash-only at rest, rotatable and revocable.
SENDER_CONSTRAINED_TOKENS
REFERENCE TESTED
DPoP proof validation and replay rejection are implemented for high-risk API profiles.
IDEMPOTENCY_FINGERPRINT
REFERENCE TESTED
Idempotency binds key to request fingerprint and rejects key reuse with a different request.
RATE_LIMITING
REFERENCE TESTED
Tenant and principal request budgets fail closed without granting authorization.
PROBLEM_DETAILS
REFERENCE TESTED
Machine-readable API failures have stable problem types and request correlation.
KEY_CUSTODY_POLICY
REFERENCE TESTED
Customer KMS/HSM, cloud KMS and seller-reference custody are distinct states.
CRYPTOGRAPHIC_AGILITY
REFERENCE TESTED
Key version, allowed algorithms, rotation and deprecation are policy objects.
PQC_MIGRATION_INTERFACE
REFERENCE TESTED
PQC migration readiness is explicit without claiming FIPS validation or deployment.
DATA_CLASSIFICATION
REFERENCE TESTED
Data classification is mandatory for protected workloads.
PURPOSE_LIMITATION
REFERENCE TESTED
Data use is bound to declared purpose and authorization.
DATA_RESIDENCY
REFERENCE TESTED
Allowed regions are policy-bound and fail closed.
RETENTION_LEGAL_HOLD
REFERENCE TESTED
Retention and legal hold override deletion deterministically.
CROSS_CUSTOMER_TRAINING_DENY
REFERENCE TESTED
Cross-customer model training is denied by default.
WEBHOOK_HMAC
REFERENCE TESTED
Webhook payloads are secret-authenticated with timestamp and nonce binding.
WEBHOOK_REPLAY_DEFENSE
REFERENCE TESTED
Duplicate webhook nonce or stale timestamp is rejected.
WEBHOOK_SSRF_GUARD
REFERENCE TESTED
Webhook targets reject loopback, link-local, private-IP and non-HTTPS destinations.
WEBHOOK_RETRY_DLQ
REFERENCE TESTED
Retries have bounded exponential backoff and dead-letter state.
HASH_CHAINED_AUDIT
REFERENCE TESTED
Security and consequential changes produce append-only hash-linked audit evidence.
SIEM_EXPORT
REFERENCE TESTED
Audit export is redacted, structured and SIEM/OpenTelemetry compatible.
BACKUP_INTEGRITY
REFERENCE TESTED
Backups carry integrity manifests and reject tampered restore.
RPO_RTO_POLICY
REFERENCE TESTED
Recovery point and recovery time objectives are explicit policy objects.
RECOVERY_DRILL_EVIDENCE
REFERENCE TESTED
Recovery drills produce attributable receipts; seller drills do not become customer evidence.
INCIDENT_KILL_SWITCH
REFERENCE TESTED
Incident state can suspend high-risk mutation while preserving read/audit access.
SECURE_BUILD_PROVENANCE
REFERENCE TESTED
SBOM, source identity, build provenance and verification are required publication inputs.
CUSTOMER_ACTIVATION_TRUTH_GATE
REFERENCE TESTED
Customer-live status requires externally signed activation evidence and cannot self-promote.
NO_EXTERNAL_EVIDENCE_SELF_PROMOTION
REFERENCE TESTED
Seller evidence cannot mint E4/E5/E6, customer-live, certification or adoption.
Threats
14 explicit threat mappings
Fail-closed states are documented so reviewers can falsify the intended protections.
cross-tenant object access
TENANT_OBJECT_AUTHORIZATION
TENANT_BOUNDARY_DENIED
stolen bearer token replay
SENDER_CONSTRAINED_TOKENS
DPOP_REPLAY_OR_BINDING_DENIED
privileged single-actor control change
SEGREGATION_OF_DUTIES
SELF_OR_INCOMPLETE_APPROVAL_DENIED
identity lifecycle drift
SCIM_2_LIFECYCLE
INACTIVE_IDENTITY_REMOVED_FROM_ACTIVE_GROUP_USE
webhook replay or forgery
WEBHOOK_HMAC
SIGNATURE_OR_NONCE_REJECTED
webhook SSRF
WEBHOOK_SSRF_GUARD
PRIVATE_LOOPBACK_OR_NON_HTTPS_TARGET_DENIED
idempotency-key semantic collision
IDEMPOTENCY_FINGERPRINT
KEY_REUSE_WITH_DIFFERENT_REQUEST_DENIED
unsafe data reuse
PURPOSE_LIMITATION
PURPOSE_OR_CROSS_CUSTOMER_USE_DENIED
legal-hold bypass
RETENTION_LEGAL_HOLD
DELETE_DENIED_WHILE_HOLD_OR_RETENTION_ACTIVE
audit erasure or silent rewrite
HASH_CHAINED_AUDIT
CHAIN_VERIFICATION_FAILS_ON_MUTATION
backup tamper or untested recovery
BACKUP_INTEGRITY
RECOVERY_READINESS_FAILS
incident-time unsafe mutation
INCIDENT_KILL_SWITCH
HIGH_RISK_MUTATION_HALTED
unsupported customer-live claim
CUSTOMER_ACTIVATION_TRUTH_GATE
CUSTOMER_LIVE_FALSE_UNTIL_ALL_EXTERNAL_GATES_PASS
supply-chain artifact substitution
SECURE_BUILD_PROVENANCE
PUBLICATION_GATE_DENIED