SOAR

Worker available

1. Scope. A reviewed case and exact approval authorize one session revocation. They do not authorize disabling an account or declaring the incident resolved. Sam’s trusted P191 names Playbook191, revoke-session, S191 and an exclusive 21:10 UTC end. The case is already reviewed; this figure does not turn an unreviewed alert into authority. S191 initially reads O191, Nora’s S192 is independently permitted, and the original stays in DrawingDesk. Directory U191 and other sessions are outside the change. Human investigation remains open.
2. Queue. The connector accepts the approved command with 202 and stores Q191 once. S191 is still active. The connector validates Playbook191 and P191’s exact action, target and exclusive expiry, then stores Q191. Reusing the same idempotency key returns Q191; a conflicting payload is refused. A 202 acknowledges processing, not application: S191 and U191 stay unchanged. This combines request, validation, storage and acknowledgement, not packet delivery.
3. Apply. The worker applies Q191 and revokes S191 at the application. The workflow has not independently tested access yet. A separate worker call attempts the queued operation. In the available path it rechecks the exact approval and records session revocation at the application, then marks Q191 applied. In the unavailable path its controlled endpoint returns 503 without changing either row. Both retain the case, approval, command and original. No automatic retry, account disable or broader response occurs. A worker status is still distinct from a fresh application-access check.
4. Probe. Fresh reads refuse S191 and still return O191 to Nora through S192. Only this session’s access removal is verified. Independent HTTP reads now test the actual session table, rather than trusting 202 or the worker report. Applied Q191 gives S191 a 401 without O191; an unavailable worker leaves S191 at 200 with the original bytes. Nora’s S192 returns 200 in both. U191 is unchanged, O191 and AL191 remain, and human investigation is open. These probes establish only the selected access results; they do not certify all-session revocation or incident resolution.

Worker unavailable

1. Scope. A reviewed case and exact approval authorize one session revocation. They do not authorize disabling an account or declaring the incident resolved. Sam’s trusted P191 names Playbook191, revoke-session, S191 and an exclusive 21:10 UTC end. The case is already reviewed; this figure does not turn an unreviewed alert into authority. S191 initially reads O191, Nora’s S192 is independently permitted, and the original stays in DrawingDesk. Directory U191 and other sessions are outside the change. Human investigation remains open.
2. Queue. The connector accepts the approved command with 202 and stores Q191 once. S191 is still active. The connector validates Playbook191 and P191’s exact action, target and exclusive expiry, then stores Q191. Reusing the same idempotency key returns Q191; a conflicting payload is refused. A 202 acknowledges processing, not application: S191 and U191 stay unchanged. This combines request, validation, storage and acknowledgement, not packet delivery.
3. Apply. The worker endpoint returns 503. Q191 remains queued and S191 stays active; the workflow reports incomplete work. A separate worker call attempts the queued operation. In the available path it rechecks the exact approval and records session revocation at the application, then marks Q191 applied. In the unavailable path its controlled endpoint returns 503 without changing either row. Both retain the case, approval, command and original. No automatic retry, account disable or broader response occurs. A worker status is still distinct from a fresh application-access check.
4. Probe. Fresh reads still return O191 through both sessions. The queued revocation has not contained S191. Independent HTTP reads now test the actual session table, rather than trusting 202 or the worker report. Applied Q191 gives S191 a 401 without O191; an unavailable worker leaves S191 at 200 with the original bytes. Nora’s S192 returns 200 in both. U191 is unchanged, O191 and AL191 remain, and human investigation is open. These probes establish only the selected access results; they do not certify all-session revocation or incident resolution.

This is a local HTTP/SQL playbook exercise, not a SOAR product or real containment. Trusted case/approval records, connector identity, protected channels and service time are assumed. S191 is a reference, not a usable credential. The 503 models one unavailable worker endpoint; recovery, broad incident resolution and all sessions are untested. Only one bounded command and selected probes run.

Flow references: ASD: response playbooks, automation risks and defined implementation scope · RFC 9110: 202 acceptance does not mean completed processing