Human Decision Queue
Security, risk and authorisation decisions requiring accountable human judgement. VERIDION analyses, reasons and recommends — authorised humans decide, and every decision is recorded.
7
2
2
3
1
- DEC-028AuthorisationCRITICALBLOCKED
Payroll Processing Platform Security Authorisation
System authorisation cannot complete while mandatory prerequisites remain unresolved.
Only the Authorising Officer may authorise system operation, and only when the assurance chain is complete.
Readiness:NOT READYBlocking items:3Authorising Officer5 evidence3 dependentTarget authorisation in 12 daysOpen - DEC-024Model ConflictHIGHREVIEW REQUIRED
API Endpoint Exposure
Observed Azure configuration indicates Azure API Management is Internet Accessible. Architecture documentation states Private.
The Digital Twin holds two conflicting positions on the same assertion. VERIDION does not resolve authoritative system state automatically.
Conflict:Private ↔ Internet AccessibleDependent objects:12Security Architect4 evidence12 dependentOverdue by 1 dayOpen - DEC-025Control ReassessmentMEDIUMREASSESSMENT REQUIRED
Internet-facing service protection
System state changed after the previous control assessment. Affected control conclusions may no longer be reliable.
A change to the authoritative system model invalidates the assumptions the prior control assessment relied upon.
Related controls:3Affected evidence:6 artefactsSecurity Assessor6 evidence4 dependentDue in 3 daysOpen - DEC-026Residual RiskMEDIUMACCEPTANCE REQUIRED
External API compromise leading to PROTECTED payroll data disclosure
Residual risk arising from Threat Path TP-017 requires an accountable acceptance decision.
Residual risk may only be accepted by the accountable Risk Owner within delegated authority.
Threat Path:TP-017Residual Risk:MEDIUMRisk Owner3 evidence2 dependentDue in 5 daysOpen - DEC-027ExceptionMEDIUMEXCEPTION REVIEW
Emergency Administrator Accounts — MFA Exclusion
2 emergency administrator accounts remain excluded from MFA.
An operational exception to a mandatory control requires accountable review and a bounded expiry.
Accounts:2 emergency adminExpiry:30 daysSystem Owner2 evidence1 dependentExpiry in 30 daysOpen - DEC-022Control AssessmentLOWAWAITING EVIDENCE
Backup restoration testing evidence
Control effectiveness determination is pending restoration-test evidence for the payroll database.
A control effectiveness conclusion may only be recorded once sufficient evidence is available.
Related control:BKP-002Security Assessor1 evidence1 dependentDue in 8 daysOpen - DEC-023ExceptionLOWTRIAGE
Legacy TLS cipher on reporting endpoint
A reporting endpoint negotiates a deprecated TLS cipher pending remediation.
A newly raised exception request awaits triage and routing to the accountable role.
Endpoint:Reporting APISystem Owner1 evidence0 dependentDue in 10 daysOpen