Payroll Processing Platform

Security Authorisation Assessment

SA
Human Decision Queue
DEC-026Residual RiskMEDIUMACCEPTANCE REQUIRED

External API compromise leading to PROTECTED payroll data disclosure

Residual risk arising from Threat Path TP-017 requires an accountable acceptance decision.

Risk Owner2 dependent objectsDue in 5 days
Question

Is the residual risk acceptable within delegated authority?

VERIDION Analysis
Machine reasoning

After applied controls, TP-017 retains a MEDIUM residual likelihood of external compromise reaching PROTECTED payroll data. The exposure change under DEC-024 may increase this residual and should be reflected before final acceptance.

Impact

  • TP-017

    Threat path

  • PROTECTED payroll

    Data at risk

  • 1

    Authorisation dependency

View Impact Graph
Evidence Considered

  • Threat Path TP-017 analysis

    External entry → payroll data

    Supporting
    Source
    VERIDION threat model
    Timestamp
    Recalculated today 10:24
    Method
    Machine observed
    Confidence
    Medium
    View Evidence
VERIDION Recommendation

Reassess before acceptance

MEDIUM confidence

Pending model conflict DEC-024 may raise this residual; acceptance should follow reassessment.

A recommendation only. It is not an approval. The accountable human below remains responsible for the decision.

Human Decision Required

Requires Residual Risk Acceptance authority (Risk Owner). Acting as Risk Owner in this demonstration.

Delegated Authority Check
Risk level
MEDIUM
Authority limit
≤ MEDIUM
System scope
Payroll Processing Platform
Classification
PROTECTED
Authority record
DEL-004

Within Delegated Authority

View Authority

Authority is evaluated by DELEGATE against the current governance model (record DEL-004). Authority is not inferred from technical access or system role.

Demo · evaluated residual
Decision Authority
  • Security Architect

    May validate system-model assertions and architecture conflicts.

  • Security Assessor

    May determine control effectiveness.

  • System Owner

    May approve treatments and operational exceptions within delegated authority.

  • Risk OwnerRequired

    May accept residual risk within delegated authority.

  • Authorising Officer

    May authorise system operation.

Authority is not transferable by discovery. A Security Architect cannot accept residual organisational risk merely because they identified it, and a Security Assessor cannot issue system authorisation.

Decision History
Immutable record
  1. YesterdayResidual risk raised from TP-017
  2. Today 10:24Flagged for reassessment after exposure change