Payroll Processing Platform

Security Authorisation Assessment

SA
Human Decision Queue
DEC-024Model ConflictHIGHREVIEW REQUIRED

API Endpoint Exposure

Observed Azure configuration indicates Azure API Management is Internet Accessible. Architecture documentation states Private.

Security Architect12 dependent objectsOverdue by 1 day
Question

Which state should VERIDION treat as the current authoritative system state?

Declared State

API Endpoint = Private

Source
Architecture Design Document
Updated
4 days ago
Validation
Security Architect validated
Observed State

API Endpoint = Internet Accessible

Source
Azure Resource Inventory
Observed
Today 09:42
Collector
Automated read-only collector
Confidence
High
VERIDION Analysis
Machine reasoning

The observed Azure configuration is newer than the architecture document and indicates that the API endpoint is currently Internet Accessible. This change increases external attack surface and affects previously assessed assurance conclusions. VERIDION has identified 12 dependent assurance objects. The discrepancy requires human resolution before the model conflict can be closed.

Impact

  • 3

    Controls potentially affected

  • 2

    Threat paths affected

  • 1

    Risks potentially affected

  • 1

    Architecture artefacts potentially stale

  • 1

    Authorisation dependencies

View Impact Graph
Evidence Considered

  • Architecture Design Document

    Declared state: Private

    Authoritative declaration
    Source
    Document of record
    Timestamp
    Updated 4 days ago
    Method
    Document of record
    View Evidence

  • Azure Resource Inventory

    Observed state: Internet Accessible

    Direct observation
    Source
    Azure Resource Inventory
    Timestamp
    Observed today 09:42
    Method
    Automated collector
    Confidence
    High
    View Evidence

  • Azure API Management configuration

    Public network access = Enabled

    Direct observation
    Source
    Azure API Management
    Timestamp
    Observed today 09:41
    Method
    Machine observed
    Confidence
    High
    View Evidence

  • Security Architect Validation

    Previous human validation of Private

    Prior validation
    Source
    Sarah Chen · Security Architect
    Timestamp
    4 days ago
    Method
    Human validated
VERIDION Recommendation

Accept Observed State

HIGH confidence

Direct observation from the current Azure configuration is newer than the architecture document.

A recommendation only. It is not an approval. The accountable human below remains responsible for the decision.

Human Decision Required

Requires Architecture Validation authority (Security Architect). Acting as Security Architect in this demonstration.

Decision Impact
Connected assurance chain

  1. DEC-024 · Accept Internet Accessible

    Model assertion decision

    Open

  2. System Model Updated

    Digital Twin assertion becomes authoritative

    Open

  3. 3 Controls Require Review

    Internet-facing service protection

    Open

  4. TP-017 Recalculated

    External attack surface increased

    Open

  5. Risk RSK-008 Reassessed

    Residual risk conclusion revisited

    Open

  6. Authorisation Decision DEC-028

    System authorisation dependency

    Open

Decisions form a connected chain — resolving one propagates to dependent objects and decisions rather than closing an isolated ticket.

Decision Authority
  • Security ArchitectRequired

    May validate system-model assertions and architecture conflicts.

  • Security Assessor

    May determine control effectiveness.

  • System Owner

    May approve treatments and operational exceptions within delegated authority.

  • Risk Owner

    May accept residual risk within delegated authority.

  • Authorising Officer

    May authorise system operation.

Authority is not transferable by discovery. A Security Architect cannot accept residual organisational risk merely because they identified it, and a Security Assessor cannot issue system authorisation.

Decision History
Immutable record
  1. 09:42Azure configuration change observed
  2. 09:43Model conflict generated
  3. 09:4312 dependent assurance objects identified
  4. 10:02Assigned to Security Architect
  5. 10:16Security Architect opened decision