Skip to content

Synthetic demo · No customer connectors attached · Fixture snapshot 24 Sep 2026, 06:15 UTC

Finding

Revoked users can still retrieve chunks from support-eu-v12

Source permissions on the ticket corpus changed 9 days ago. The index ACL sync job last completed on 15 Sep, so chunk-level entitlements still reflect the old grants. A user removed from grp-support-agents retains a resolvable retrieval path.

Observed at 24 Sep 2026, 06:15 UTCfnd-2291R24 — index ACL driftdetected 24 Sep 2026, 02:35 UTClast observed 24 Sep 2026, 06:10 UTC

Summary

Severity
critical
Status
mitigating
Evidence freshness
Pass
Remediation
rem-8801

Potential access

Paths that could reach the data. These are capability, not proof of disclosure.

  • 41,200 chunks derived from confidential ticket content
  • 3 former contractors removed from grp-support-agents on 15–19 Sep

Observed disclosure

Only what collection actually recorded leaving the boundary.

  • 1 retrieval by usr-contractor-12 at 2026-09-21 14:08 UTC returned 3 chunks containing customer contact details

Affected records

Actors

  • usr-contractor-12
  • usr-contractor-27
  • grp-support-agents

Continue the investigation

The sample code-to-cloud path is a separate synthetic scenario; a link here does not establish that it caused this finding.

Inspect bounded code-to-cloud evidence →Review collection gaps →Inspect evidence register →

Mitigations in place

A mitigation reduces exposure; it does not close the finding until verification passes.

Scroll table sideways for more columns →

MitigationStatusNote
Index quarantine for affected namespacePartialApplied to 2 of 3 shards; shard 3 write lock pending.
Forced ACL resyncPassCompleted 2026-09-24 03:10 UTC.
Verification retest of the forbidden pathUnknownNot yet run. Closure requires it.

Evidence

  • Index ACL drift snapshot restricted preview

    ev-idx-9 · scan · producer collector-eu-03 · collected 24 Sep 2026, 02:30 UTC (4 h ago)

    SignedValid to 1 Oct 2026, 00:00 UTC

  • Boundary receipt for the observed retrieval restricted preview

    ev-bnd-501 · receipt · producer mesh-boundary-eu · collected 21 Sep 2026, 14:08 UTC (3 d ago)

    SignedValid to 21 Dec 2026, 00:00 UTC