Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.
T27 · Object IDs and errors reveal no private existence
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software |
| Layer / kind | API · security |
| Priority | P0 |
| Gates | A03, A06, A09 |
| Build step | Step-03-Policy-Pipeline-and-Isolation-Harness |
| Decisions | Q08 |
Given
B knows a valid C private ID and a non-existent ID; attacker submits forged tenant/actor IDs.
When
Probe read, edit, export if present, search/count, action, audit and all enabled API variants.
Then / oracle
Server derives company and actor. Unauthorised existing versus non-existent private objects have the agreed indistinguishable denial contract; no private metadata, canary, IDs or validation hints escape. No mutation occurs.
Evidence required
Status/body/header comparison; side-effect diff; enabled-route coverage inventory.
Decision dependency (verbatim)
Q08: define safe denial shape; exports not included are recorded Unavailable, not Passed.
Source: TDD rev 1.3 (PDF); machine-readable in 10-Sources/tdd-bundle/. Back to Scenario-Index · Traceability-Matrix · integration dependencies in Dependency-and-Regression-Table.