PolicyDeltaRead the JSON evidence
Before / after policy review

Build service policy expansion

OpenBao 2.7.0 · Disposable local servers · 11 declared requests

Policy change needs review

4 newly allowed · 0 newly denied · 4 expectation mismatches · 0 execution errors

Scroll horizontally to compare the two revisions.

Case / principalRequestBeforeAfterFinding
build-readbuilderGETci/data/build/joballow HTTP 200
Expected allow
Capabilities: read
allow HTTP 200
Expected allow
Capabilities: read
Expectations met
explicit-denybuilderGETci/data/build/private/keydeny HTTP 403
Expected deny
Capabilities: deny
deny HTTP 403
Expected deny
Capabilities: deny
Expectations met
sibling-prefixbuilderGETci/data/build2/jobdeny HTTP 403
Expected deny
Capabilities: deny
allow HTTP 200
Expected deny
Capabilities: read
expectation mismatch
unapproved expansion
other-teambuilderGETci/data/team/proddeny HTTP 403
Expected deny
Capabilities: deny
allow HTTP 200
Expected deny
Capabilities: read
expectation mismatch
unapproved expansion
metadata-listbuilderLISTci/metadata/buildallow HTTP 200
Expected allow
Capabilities: list
allow HTTP 200
Expected allow
Capabilities: list
Expectations met
write-remains-deniedbuilderPOSTci/data/build/jobdeny HTTP 403
Expected deny
Capabilities: read
deny HTTP 403
Expected deny
Capabilities: read
Expectations met
permitted-parameterbuilderPOSTlegacy/releaseallow HTTP 204
Expected allow
Capabilities: create, update
allow HTTP 204
Expected allow
Capabilities: create, update
Expectations met
forbidden-parameterbuilderPOSTlegacy/releasedeny HTTP 403
Expected deny
Capabilities: create, update
allow HTTP 204
Expected deny
Capabilities: create, update
expectation mismatch
unapproved expansion
capabilities unchanged
missing-parameterbuilderPOSTlegacy/releasedeny HTTP 403
Expected deny
Capabilities: create, update
allow HTTP 204
Expected deny
Capabilities: create, update
expectation mismatch
unapproved expansion
capabilities unchanged
delete-fixturebuilderDELETElegacy/ephemeralallow HTTP 204
Expected allow
Capabilities: delete, read
allow HTTP 204
Expected allow
Capabilities: delete, read
Expectations met
read-after-deletebuilderGETlegacy/ephemeralallow HTTP 200
Expected allow
Capabilities: delete, read
allow HTTP 200
Expected allow
Capabilities: delete, read
Expectations met

Results cover these declared requests and fixtures. They do not establish all possible access, production behavior, or complete policy safety. A deny requires HTTP 403; missing data, setup failures, and other errors do not count as successful denial tests. Request bodies, returned secret values, and tokens are excluded from this report.

Input identities
Suite SHA-256
d52d390f4c5f0f2e45e403342d527d7b6717f23d452737cfc3bd1040a3d7fc44
before / build
cf5aa84764a483896cd8c5cf2a7f55c6938f4f5e03dc07a91c9e02657bb55eec
after / build
fecd18a169c781fe68fae014ed76e126a2bb52ba13b52a1eb8a6b2024773b3f8