# What the experiment can and cannot establish

The falsifiable claim is finite: under the recorded configuration, the selected identity's direct R/S/C reads behaved as recorded and narrow recovery preserved the intended boundary.

Not proven by this kit:

- All reachable consequences, all credentials on the VM, or universal containment. AzureCloud HTTPS egress is intentionally available for management and is a residual path.
- Cross-tenant, service-mediated copy/export, federation, shared DNS consumers, hostile administrators or control-plane compromise.
- Existing-session termination, immediate RBAC/token revocation, every application's DNS/cache behavior or production recovery time.
- Complete effective permissions. Listed direct assignments to a new lab identity are inspected, but group membership, policy/deny assignments, delegated management or undisclosed identity compromise need separate review.
- Causal attribution from a timeout, absence of service rows, a configured route, or temporal proximity.
- Log ingestion latency, real-time alerting or ongoing drift detection. Queries and manual management-history collection need live validation.
- Zero spend or a hard automatic cap. Estimate review, expiry and group deletion cannot eliminate billing lag.
- Cryptographic authenticity of events. Local evidence can be edited; hashes and schema validation do not establish independent custody.

State assertions check the lab worker's assignments/NSG and resource inventory. They are not exhaustive deep-drift validation for every resource property; before a live run an independent operator must review Storage public-access settings, endpoint approval/IP/DNS, NIC public IP absence, VNet peerings/routes, diagnostics and the approved management egress. Never assume a resource's expected name proves its properties.

REST 403 codes are preserved as service denials, but the code alone does not establish which exact grant caused them. Review identity selection, token audience, role snapshots and unchanged network state. The custom pinned-IP client preserves TLS hostname verification, but it does not demonstrate an arbitrary application's actual peer selection.

Only the required-read authorization failure is automated for recovery. DNS fault, existing-session tests, shared resolver outages and broad network isolation are deliberately not implemented. Add any extension as a separately reviewed bounded case with independent rollback, tests and a new release version.

Status: **one authorized finite Azure trial; independent reader replay and settled-cost review pending**. VALIDATION.md records the actual comparisons and the initial revocation-delay failure. Earlier series' lab results are not measurements of this toolkit.