Status. Proposed design only. Nothing in this vault is GGA client approval. The GGA client documents are supplied drafts: see GGA-Source-Digest. No application, service or test has been executed; every scenario is Not executed. Delivery fees and dates are open.
GS26 · Privileged access, MFA and audit
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software (new in the GGA baseline) |
| Source | Blueprint pp. 3, 17 (GGA-Requirement-Register); client-supplied draft, not accepted |
| Gate | GA09 |
| Blueprint delivery stage | Stage 2 Foundation and publishing (p. 19) |
| Build step | 03 (primary; tests first) |
| Replaces or carries | DG22, T28, T37 |
| Decisions | — |
Given
Operations, finance and technical administrator accounts; one exceptional support access request; an export request.
When
Sign in without MFA; browse business data as the technical administrator; request an export with and without a reason; take an administrative override; record a finance change.
Then / oracle
Privileged staff need MFA. The technical administrator has no routine browsing of business data and any exceptional access is logged. Sensitive overrides and exports require a reason and are audited. Grants, exports, overrides and finance changes are logged without tokens or unnecessary personal data. Business and technical privileges are separated; secrets are outside source control.
Evidence required
Authentication policy evidence; audit rows; token and secret scan of logs.
Decision dependency
None. The rule is stated in the Blueprint page cited above.
Where a decision is pending, the dependent assertion is Blocked by that decision and no oracle is invented. A proposed default is a configuration value, not a promise. This note is a specification: it is Passed only on a named integrated build and fixture.
Back to GGA-Scenario-Index · GGA-Traceability-Matrix · Scenario-Dispositions.