Protect / Synthetic demo
Remediation
Preview changes, verify outcomes, and keep partial work visible. No change can be submitted from this prototype.
2 plans are partially applied. Remaining steps and compensating actions stay listed; nothing is reported as complete.
rem-8801 · Bounded response
Quarantine support-eu-v12 and resync chunk entitlements
- 1Proposed
- 2Previewed
- 3Awaiting approval
- 4Applying
- 5Partially applied
- 6Failed
- 7Verified
Change plan
Partially applied. Shard 3 was never mutated, so no compensation is owed for it, but the finding stays open and the plan remains actionable until shard 3 is quarantined and the forbidden-path retest passes.
− support-eu-v12: 3 shards serving, chunk ACL snapshot dated 2026-09-15, 3 revoked principals still resolvable.
+ support-eu-v12: shards 1–2 quarantined and resynced to the 2026-09-24 ACL snapshot. Shard 3 unchanged and still serving the stale snapshot.
Authority: index-admin (scoped to namespace support-eu, expires 2026-09-25 06:00 UTC)
Scope
namespace support-eu · 41,200 chunks
Requested by
Priya Raman
Approved by
Jonas Weber
Level
source mutation
Verification checks
- Read back shard ACL version from the sourceShards 1–2 report the 2026-09-24 snapshot. Shard 3 still reports 2026-09-15.partial
- Forbidden path: usr-contractor-12 retrieval deniedNot yet executed. This plan cannot be closed until it runs.unknown
- Legitimate path: grp-support-agents retrieval succeeds40 of 40 control queries returned expected results.pass
Simulation only. No credentials or source mutations are used.