# Bring the question to your own environment

Use this paper worksheet before adapting any source. It grants no testing authority.

## Claim contract

| Field | Your answer |
|---|---|
| Authorized environment, scope and owner | |
| Source workload and explicitly selected principal | |
| Required business operation and exact object/service | |
| Unwanted operation and plausible consequence | |
| Name-resolution, route and service-authorization dependencies | |
| Other credentials, inherited/group grants or service-mediated paths | |
| Candidate identity control and expected negative result | |
| Candidate network control and what it cannot distinguish | |
| Positive availability control | |
| Independent operator recovery path and acceptable interruption | |
| Price estimate, numeric maximum, cleanup owner/deadline | |
| Preregistered request, readiness and observation budgets | |

## Coverage and outcome ledger

| Case/state | Expectation | Actual outcome or NOT_RUN | UTC / evidence reference | Source/identity/config version | Gap/owner |
|---|---|---|---|---|---|
| Baseline | | NOT_RUN | | | |
| Identity-only | | NOT_RUN | | | |
| Network-only | | NOT_RUN | | | |
| Combined | | NOT_RUN | | | |
| Required-service failure | | NOT_RUN | | | |
| Narrow recovery | | NOT_RUN | | | |
| Teardown | | NOT_RUN | | | |

For each claim, map client observation, identity context, DNS answer, effective route/rule, control-plane event and destination resource log separately. Which source actually observes the claimed outcome? Which is merely configured state? What result would falsify your explanation?

## Decision

Document rejected alternatives and cost/availability trade-offs. Do not rank success by deployed-control count. If a network control cannot distinguish two containers, identify which authorization boundary must do that work. If the required operation fails, the security treatment has not met its service objective.

Count executed attempts separately from distinct paths. Report unexpected allows and unexecuted cases. Do not turn a finite lab change into a tenant-wide risk-reduction percentage.

Release only the conclusions supported by observations. Assign every residual risk and evidence gap an owner or an explicit out-of-scope decision. Use stable aliases in public artifacts; keep raw identifiers and secrets under restricted custody.