CSPM

Live + source

1. Inspect. The read-only collector retains C170’s public-read setting. Sam’s private-object rule and W170’s legitimate grant are known; no correction has run. The selected C170 snapshot, original O170 and deployment definition D170 are retained independently. D170 would currently recreate public reading. Sam owns the private-object decision and Nora may apply that exact correction. Assessment permission does not permit resource mutation. This exercise assumes no other network or policy layer changes the selected endpoint’s result.
2. Assess + test. The rule comparison records F170. Separate fresh probes return O170 to an anonymous reader and permitted W170, without changing the object. The selected batch compares the collected public-read flag with Sam’s private rule, records F170 and independently checks effective object reads. Both readers return 200 with the same synthetic O170. A configuration comparison alone would not prove those responses. F170 is a scoped policy violation, not a demonstrated prior theft or a complete cloud assessment. The read-only collector cannot repair it.
3. Correct. Nora applies Sam’s approved private setting to C170 and D170. No deployment replay or fresh access test has completed yet. The primary batch changes the live public-read gate and the selected deployment source to private. The comparison changes the live gate only and retains D170’s old public setting. Both branches preserve W170’s read grant, original O170, old snapshot and F170. Mutation authority is separate from the collector’s read access. A successful setting update is not the later deployment or access result.
4. Redeploy + test. After D170 is replayed, fresh checks refuse anonymous reading and still return O170 to W170. The selected rule passes; the originals remain. The selected deployment is actually replayed before the new setting is read and independent HTTP object probes run. With corrected D170, C170 stays private: anonymous 403 without the object, W170 200 with O170. With the old D170, public reading returns: anonymous 200 and W170 200. The original snapshot and F170 remain historical records, not rewritten passing evidence. Other deployments, resources and prior disclosure stay unassessed.

Live change only

1. Inspect. The read-only collector retains C170’s public-read setting. Sam’s private-object rule and W170’s legitimate grant are known; no correction has run. The selected C170 snapshot, original O170 and deployment definition D170 are retained independently. D170 would currently recreate public reading. Sam owns the private-object decision and Nora may apply that exact correction. Assessment permission does not permit resource mutation. This exercise assumes no other network or policy layer changes the selected endpoint’s result.
2. Assess + test. The rule comparison records F170. Separate fresh probes return O170 to an anonymous reader and permitted W170, without changing the object. The selected batch compares the collected public-read flag with Sam’s private rule, records F170 and independently checks effective object reads. Both readers return 200 with the same synthetic O170. A configuration comparison alone would not prove those responses. F170 is a scoped policy violation, not a demonstrated prior theft or a complete cloud assessment. The read-only collector cannot repair it.
3. Correct. Nora restricts live C170, but D170 still specifies public reading. No deployment replay or fresh access test has completed yet. The primary batch changes the live public-read gate and the selected deployment source to private. The comparison changes the live gate only and retains D170’s old public setting. Both branches preserve W170’s read grant, original O170, old snapshot and F170. Mutation authority is separate from the collector’s read access. A successful setting update is not the later deployment or access result.
4. Redeploy + test. Replaying old D170 restores public reading. Fresh anonymous and W170 probes both return O170; the live-only correction did not survive deployment. The selected deployment is actually replayed before the new setting is read and independent HTTP object probes run. With corrected D170, C170 stays private: anonymous 403 without the object, W170 200 with O170. With the old D170, public reading returns: anonymous 200 and W170 200. The original snapshot and F170 remain historical records, not rewritten passing evidence. Other deployments, resources and prior disclosure stay unassessed.

This is one SQL/HTTP-modeled object-read policy, not an AWS/Azure policy engine. Trusted collector/owner/operator identities and an otherwise reachable endpoint are assumed. Other policy layers, regions and resources are unassessed. A configuration finding is not proof of past theft; a refused fresh read does not recall earlier copies. Only the selected deployment replay is tested.

Flow references: Microsoft: cloud posture and distinct CNAPP capabilities · NIST SP 800-210: cloud data-owner access control