A fifth escalation begins when post-re-release surveillance finds a material federated entitlement recurrence. Recovery must stop the faulty claim from crossing system boundaries while preserving the valid identity, controlled package and evidence needed to understand what happened. Disabling every account may look decisive, but it can interrupt unaffected work and erase the distinction between a bad claim and a bad person.
This guide continues the recurrence-surveillance work. It shows how to quarantine a federated claim path, repair the earliest authority, invalidate active assertions, reconcile archives and workflows, investigate package use separately and conduct a fifth re-release that deliberately exercises the lifecycle event that caused the recurrence.
The Gold Standard is evidence continuity with least necessary disruption. Access recovery and polymer-science integrity remain connected through identity, package and workflow records, but a claim recurrence is not automatically a formulation change or a compromised analytical result.
A practical orientation
Think in boundaries: source identity, identity provider, federation broker, destination application, archive, workflow and evidence store. Quarantine should stop the faulty claim at the narrowest reliable boundary while preserving approved current-project access where the systems can separate the two safely.
The worked example returns to a contractor renewal that revives a legacy acquisition claim. Recovery quarantines that claim, preserves the current project identity, repairs the renewal template, invalidates tokens and replays renewal and mover events before staged re-release.
- Stabilise the fifth escalation — for owners containing access without destroying evidence.
- Quarantine the federated path — for identity and application teams.
- Follow the contractor recovery — for an end-to-end example.
- Apply fifth re-release gates — for quality and release authorities.
- Transfer to another federation — for changed identifiers and token lifetimes.
Chapter contents
Open a route that matches the decision in front of you, or read straight through. Each route returns to the same evidence chain.
Start with the operating question
Stabilise the fifth escalation and preserve the first evidence
Build the evidence chain
Repair the earliest authority before downstream symptoms
Work the example
Worked example: recover from a renewal-triggered legacy claim
1. Stabilise the fifth escalation and preserve the first evidence
Record the detected identity, recurrent claim, issuing system, token time, destination role, affected package scope and observed use before changing state. Preserve relevant assertions, audit events, group memberships, package identifiers and workflow decisions. A screenshot helps orientation but cannot replace machine records and time-bounded effective access.
Apply immediate protection proportionate to the known consequence. Block the recurrent claim or the affected destination path where reliable separation exists. If scope is uncertain or write authority may be active, suspend the broader identity while preserving the evidence and a route for controlled investigation.
- Identity, subject identifier and authoritative contract state.
- Recurrent claim, token and federation path.
- Destination roles, archive permissions and workflow authority.
- Package version, hash, provenance and observed actions.
- Containment owner, time, scope and reversal conditions.
2. Choose the narrowest quarantine that remains dependable
A claim quarantine can reject one attribute value at the federation broker, deny its mapping at a destination or route the identity to a restricted role. The narrowest option is useful only if every relevant path honours it. A hidden local account or alternate broker can make a precise control illusory.
Document which access remains valid. Quarantining a retired acquisition claim should not silently remove the contractor’s approved current-project work unless systems cannot separate them safely. Where separation is unreliable, use broader containment and state the operational cost rather than pretending precision.
| Boundary | Control | Key limitation |
|---|---|---|
| Authoritative source | Disable or remove faulty entitlement | Active tokens may persist |
| Federation broker | Reject or transform recurrent claim | Alternate paths may bypass broker |
| Destination application | Deny mapping or local role | Other destinations remain exposed |
| Whole identity | Suspend all access | Interrupts approved work and reduces diagnostic precision |
3. Repair the earliest authority before downstream symptoms
Trace the recurrent claim backwards through archive mapping, federation assertion, identity-provider transformation and authoritative source. Repair the earliest rule that incorrectly grants or revives the entitlement. A destination-only removal can be overwritten at the next synchronisation.
If the source is correct and transformation is wrong, repair the mapping rather than rewriting the source to compensate. Keep the expected entitlement model separate from current effective state so reconciliation can prove that both have converged.
4. Invalidate assertions and reconcile every downstream system
Removing the source entitlement does not revoke an already issued assertion. Invalidate sessions and tokens according to system capabilities, wait the declared propagation interval, then compare expected and effective state at the broker, archive, workflow, application groups and any shadow account store.
Use independent evidence: newly issued claims, destination audit events, permission calculations and controlled test actions. Do not rely on the same synchronisation job to change state and certify its own success.
| Layer | Recovery action | Verification |
|---|---|---|
| Source | Repair renewal or role template | Approved entitlement snapshot |
| Issuer/broker | Invalidate and reissue claims | Captured assertion matches policy |
| Archive | Recalculate groups and object scope | Effective permission and access test |
| Workflow | Confirm reviewer or approver role | Decision event uses current identity |
| Evidence store | Link incident, repair and package record | Complete reconstructable chain |
5. Investigate access use and package integrity separately
Determine whether the recurrent authority was exercised: read, export, write, approve, release or administrative actions. Then determine whether the controlled polymer package changed by comparing version identifiers, hashes, audit trails and workflow history. One answer cannot substitute for the other.
An unchanged package hash does not erase an unauthorised read. A recurrent read-only claim does not prove a formulation or analysis changed. State each conclusion at the level supported by evidence and preserve unresolved gaps.
6. Worked example: recover from a renewal-triggered legacy claim
A contractor retains a valid current-project role, but renewal revives a retired acquisition claim. The broker passes both claims, and the archive grants broad historical read access. The workflow application ignores the legacy claim and keeps the correct reviewer role. Surveillance detects the mismatch before any write or approval action.
The team quarantines the acquisition claim at the broker and archive, preserves current-project access, captures the active assertion, invalidates sessions and repairs the renewal template at the authoritative directory. Archive logs show two object-list views but no file retrieval; package hashes and workflow history remain unchanged. Renewal is replayed after repair, followed by a mover event to test that the old project role is also removed correctly.
| Step | Evidence | Decision |
|---|---|---|
| Contain | Legacy claim reaches archive | Quarantine claim and archive path |
| Preserve | Current-project claim remains valid | Keep approved work where separable |
| Investigate | Two listings; no retrieval, write or approval | Record exposure without inventing package change |
| Repair | Renewal template revives old group | Correct earliest authority and invalidate tokens |
| Replay | Renewal and mover transitions pass | Advance to limited fifth re-release |
7. Replay the lifecycle event that caused recurrence
A clean ordinary sign-in is weak recovery evidence when renewal created the fault. Re-run renewal with a controlled identity, observe source state, issued claims, destination permissions and token refresh, then test mover and leaver transitions that share the same template or mapping code.
Include a negative test proving the retired acquisition claim does not return and a positive test proving the approved current-project claim still works. Recovery should remove the fault without breaking the legitimate path.
8. Set evidence-continuity fifth re-release gates
Re-release requires repaired authority, invalidated stale assertions, reconciled downstream state, a passed triggering-event replay, bounded package-use findings, linked evidence and an exercised quarantine or rollback. The gate should name which identities, roles, systems and packages are admitted.
When one destination cannot prove convergence, re-release the verified paths and keep that destination quarantined. Partial re-release is stronger than either indefinite total shutdown or unsupported full restoration.
- Earliest faulty authority repaired and independently reviewed.
- Tokens, sessions and transformed claims reconciled.
- Archive, workflow and local accounts match expected state.
- Triggering lifecycle event and negative tests pass.
- Package use and integrity conclusions are separately supported.
- Quarantine, monitoring and residual restrictions have owners.
9. Stage the fifth re-release through increasing authority
Begin with the least authority that supports the task, such as read access to the current project. Observe token renewal and a synchronisation cycle before restoring write, approval or release roles. Each expansion should have a test, an owner and a clear rollback path.
Heightened monitoring should cover the next real renewal or deliberately exercised equivalent. A re-release window that ends before the causative event recurs offers little evidence about recurrence.
10. Preserve continuity without overwriting the incident
Link the pre-incident entitlement snapshot, recurrence signal, quarantines, token invalidation, repaired configuration, lifecycle replays, package-use assessment and re-release decision. Do not replace the faulty snapshot with the corrected one. The difference is the evidence.
Where systems use different clocks, record offsets or a common time source. Where logs are incomplete, state the gap and the corroborating records. Evidence continuity means that the chain is honest and reconstructable, not that uncertainty is hidden.
11. Misconceptions, practical questions and transfer
Common errors include disabling everything before preserving evidence, fixing only the archive, assuming token revocation is instantaneous, using a clean hash as proof that access was acceptable, and testing sign-in instead of renewal. Recovery follows the actual authority path and actual trigger.
Should the whole identity be disabled when one federated claim recurs?
Use the narrowest dependable containment. If systems can reliably separate the faulty claim, preserve approved access. If scope or bypass paths are uncertain, broader suspension is justified until control is restored.
Can re-release proceed when one archive log is incomplete?
Only with the gap stated, compensating evidence assessed and residual risk governed. Restrict the affected path if the missing record prevents a credible package-use or access conclusion.
12. Changed-context evidence check and authoritative sources
Transfer the method to a vendor federation that changes the subject identifier and token lifetime. Rebuild identity correlation, test the alternate broker path, verify revocation timing and repeat the causative transition. Do not assume that a familiar group name or email address proves the same identity across federations.
ICH Q10 Pharmaceutical Quality System describes lifecycle quality management, change management, corrective action and management review. NIST SP 800-53 Revision 5 provides control families for access, identification, audit and monitoring. These sources support the control framework; local regulated duties and system evidence determine the exact re-release gate.
Continue through the Gold Standard ecosystem
Return to the Polymer Science subject root, the Gold Standard of Education parent, or the How X Works hub.
Immediate predecessor: post-fourth-re-release entitlement surveillance and fifth-escalation gates · Earlier guide: fourth-escalation recovery and evidence-continuity re-release · Polymer Science root
These routes are grouped by learning purpose: prerequisite model, immediate predecessor, and the wider transfer framework. They are not substitutes for the evidence and limits stated in this guide.