The Gold Standard · Experimental Design
Make the decision path visible
Authority reconciliation can be correct today and wrong again after a backup restore, role-template change, emergency grant or repository migration. The old interim permission may reappear without anyone changing the final decision record. A scheduled job then succeeds because enforcement drifted away from authority.
The gold standard treats active permission as a continuously evidenced state. It detects reopened paths, freezes their effects, traces what ran and repairs the source template or inheritance rule so the same permission does not return after the next routine change.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · DETECT REOPENED AUTHORITY
1. Define reconciliation drift
Reconciliation drift exists when effective permissions no longer match the current final decision after they once converged. The cause may be restoration, inheritance, migration, emergency access or manual change.
A correct decision record does not prevent drift; controls must continue to demonstrate the state it requires.
CHAPTER 2 OF 12 · DETECT REOPENED AUTHORITY
2. Compare authority with effective access
Build a regular comparison between decision version, repository roles, scheduler identities, export gates and downstream approval records. Include indirect group membership and service accounts.
Nominal role lists can look correct while inherited groups or duplicated jobs still confer practical execution.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · DETECT REOPENED AUTHORITY
3. Set recurrence signals and owners
Treat a denied action that suddenly succeeds, an old role returning, a duplicate schedule or a stale approval version as an incident trigger. Assign who can suspend the path immediately.
Detection without response authority leaves the system exposed while teams debate ownership.
| Source | Expected evidence |
|---|---|
| Final decision | Current version |
| Identity | Effective membership |
| Scheduler | Active jobs |
| Export gate | Enforced rule |
CHAPTER 4 OF 12 · CONTAIN AND TRACE
4. Freeze the reopened path
Disable the affected role, job or export route, preserve logs and isolate current outputs. Keep bounded evidence access when the final decision permits it.
Containment should remove practical authority without erasing the evidence needed to reconstruct the recurrence.
CHAPTER 5 OF 12 · CONTAIN AND TRACE
5. Trace the earliest plausible return
Inspect backups, identity events, template updates, repository migrations, emergency grants and configuration histories. Determine when the permission first became effective, not only when it was noticed.
The exposure window begins with enforceable access, even if nobody used it until later.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · CONTAIN AND TRACE
6. Worked example: a restored group restarts the export job
A disaster-recovery restore brings back an identity group that held the former interim export permission. The final decision still rejects current export, but the monthly scheduler inherits the restored group and completes one run.
The owner disables the job, quarantines the output and removes the permission from both the group and the recovery template. Changed-context check: if the restored group is required for an authorised historical replica, separate environments and service identities so that historical access cannot reach the current export path.
| Field | Purpose |
|---|---|
| First effective time | Bounds exposure |
| Reopened path | Defines control |
| Outputs | Shows consequence |
| Owner | Directs response |
CHAPTER 7 OF 12 · REPAIR THE SOURCE
7. Repair the source of enforcement drift
Correct parent groups, role templates, recovery images, infrastructure definitions and default policies, not only the visible leaf permission. Add version checks where authority-bearing services start.
Leaf-only repair produces a clean snapshot while the source remains ready to reopen the same path.
CHAPTER 8 OF 12 · REPAIR THE SOURCE
8. Reconcile outputs and downstream decisions
Trace runs, exports, publications and decisions during the exposure window. Withdraw, replace or recompute material current uses while preserving evidence and stable findings.
A governance breach does not by itself prove scientific invalidity; repair should follow the consequence of the unauthorised activity.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · REPAIR THE SOURCE
9. Test changed-context enforcement
Restore a backup, rename a repository, rotate a service account, apply an emergency grant and migrate the scheduler in a controlled environment. Confirm forbidden actions remain blocked.
Negative tests prove more than configuration inspection because they exercise the actual path that would confer authority.
| Source | Repair |
|---|---|
| Parent group | Remove inheritance |
| Recovery image | Update baseline |
| Role template | Narrow purpose |
| Default policy | Add final-version check |
CHAPTER 10 OF 12 · PROVE ALIGNMENT
10. Use continuous effect evidence
Collect denied test results, active-role comparisons, scheduler state, export-gate versions and exception expiries. Escalate missing or contradictory evidence.
Continuous evidence should be proportionate and privacy-aware, but authority-bearing paths need more than annual review.
CHAPTER 11 OF 12 · PROVE ALIGNMENT
11. State limits and misconceptions
No comparison can discover every personal token, local copy or unsanctioned replica. Aggressive revocation can also obstruct legitimate record retention if purpose is not separated.
Record untested systems, emergency boundaries and residual permissions with owners and expiry.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · PROVE ALIGNMENT
12. Audit decision-to-enforcement resilience
Track drift signal, cause, exposure window, containment, source repair, affected outputs, negative tests and recurrence. Feed lessons into recovery and migration procedures.
The gold standard keeps authority aligned after ordinary change. Interim permission cannot regain permanence through inheritance, restoration or operational convenience.
| Signal | Warning |
|---|---|
| Role returns | Template stale |
| Job reappears | Recovery gap |
| Export succeeds | Gate mismatch |
| No effect receipt | State unknown |
Frequently asked questions
How is reconciliation drift different from initial propagation failure?
Initial propagation never achieved full effect; drift occurs after systems once matched the final decision and later moved away from it.
Is removing the visible role enough?
Not when inheritance, templates or recovery images can recreate it. Repair the source that conferred the permission.
What happens to outputs from the exposure window?
Assess their current consequence, then withdraw, replace or recompute material uses while preserving the audit record.
How can recurrence be tested?
Exercise backup restoration, migration, emergency access and service-account changes, including negative attempts at the forbidden action.
Continue through verified routes
Core routes
Experimental Design subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Final decision propagation failures, stale interim permissions and authority reconciliation
- Approval conflict escalation deadlock, interim authority boundaries and final decision recording
- Second-line approval conflicts, conditional reauthorisation and escalation
- Exception reauthorisation conditions, purpose drift and second-line approval