A fourth re-release restores controlled work after a cross-system entitlement failure, but restoration is not the final proof. Identity sources, federation services, destination applications, archives and workflow engines continue to synchronise. A dormant legacy claim can return during a contractor renewal, a mover event or an acquisition import even when ordinary sign-in tests remain clean.
This guide continues the fourth-escalation recovery work. It shows how to surveil the repaired entitlement graph, attach tests to lifecycle events, separate an access recurrence from a scientific package change and open a fifth escalation only when the evidence identifies a material cross-system failure or an unverifiable control state.
The Gold Standard is evidence continuity. The team preserves who authorised access, which claim crossed each boundary, what the destination computed, which evidence accompanied the released package and how the system will contain a recurrence without destroying the record needed to diagnose it.
A practical orientation
Treat access as a graph rather than a single account. The authoritative identity, federation assertion, destination group, archive permission and workflow role may agree during ordinary use yet diverge during renewal, transfer or deprovisioning. Surveillance therefore follows both steady-state access and event-driven transitions.
The worked example follows a contractor whose legacy acquisition claim returns only after renewal. The archive grants read access while the workflow application remains correct. That partial recurrence is enough to contain the affected path and repair the earliest authoritative source, but it does not imply that the underlying polymer data or analysis changed.
- Map the released entitlement graph — for owners defining surveillance scope.
- Test lifecycle recurrence — for identity and quality teams.
- Follow the contractor example — for a cross-system diagnosis.
- Apply fifth-escalation gates — for accountable containment.
- Transfer to another federation — for changed vendors and claims.
Chapter contents
Open a route that matches the decision in front of you, or read straight through. Each route returns to the same evidence chain.
Start with the operating question
Build the evidence chain
Attach recurrence tests to lifecycle events
Distinguish access recurrence from scientific package change
Work the example
Worked example: contractor renewal revives a legacy acquisition claim
Repair the earliest authority and reconcile downstream state
Stress-test the decision
1. Map the fourth re-release as an entitlement graph
Record every system that can create, transform, store or enforce the entitlement: authoritative directory, identity provider, federation broker, destination application, archive, workflow engine and evidence repository. For each edge, capture the source claim, transformation rule, synchronisation direction, delay, owner and revocation mechanism. A clean destination screenshot cannot prove the graph is clean.
Tie the map to the fourth re-release decision. State which identities, roles, projects, packages and time window were restored; which paths remained quarantined; and which compensating controls are still active. Surveillance should test that released scope, not an undefined idea that access is now fixed.
- Authoritative identity and employment or contract state.
- Federated claims, group transforms and token lifetime.
- Destination roles, archive permissions and workflow authority.
- Package identity, evidence bundle and release decision.
- Revocation path, quarantine control and accountable owner.
2. Combine steady-state and transition surveillance
Steady-state checks ask whether current access matches the approved entitlement matrix. Transition checks ask whether lifecycle events create the right state and remove the old one. Both are needed. A nightly reconciliation may show no difference on Monday and still miss a renewal rule that briefly or persistently recreates a retired claim on Tuesday.
Use independent evidence where practical: source records, issued assertions, destination audit events, archive access logs and workflow decisions. The aim is not to collect every possible log. It is to make the relevant entitlement path reconstructable and to detect a recurrence before it changes controlled work.
| Layer | Example check | Failure revealed |
|---|---|---|
| Authority | Contract and project state match approval | Legacy or orphaned source entitlement |
| Federation | Issued claims match mapping policy | Transform or cache recreates a claim |
| Destination | Effective role equals approved role | Local group or shadow account divergence |
| Evidence | Package and decision trail remain linked | Access event cannot be tied to controlled work |
3. Attach recurrence tests to lifecycle events
Prioritise events that rewrite entitlement state: joiner, mover, leaver, contractor renewal, vendor reassignment, acquisition import, project closure, role-template revision and emergency access expiry. For each event, state the expected before and after claims at every system boundary and the maximum acceptable propagation interval.
Exercise representative events in a controlled environment and sample real events with approved evidence. Include negative tests: a renewal should not revive a retired acquisition group, a mover should not retain the old project role, and a leaver should not keep archive access through a local account.
4. Distinguish access recurrence from scientific package change
An entitlement recurrence changes who can see, alter, approve or release controlled material. It does not by itself prove that a polymer formulation, instrument record, analysis or package changed. Preserve hashes, version identifiers, audit trails and workflow decisions so the two questions can be answered separately.
If a recurrent entitlement allowed write or approval authority, investigate whether that authority was exercised and whether downstream outputs changed. If it provided read-only access, assess exposure and obligations without inventing a scientific modification. This distinction keeps containment proportionate and prevents an access incident from erasing a valid evidence chain.
| Question | Evidence | Possible conclusion |
|---|---|---|
| Who had effective authority? | Claims, roles, logs and token times | Entitlement recurred or remained correct |
| Was authority exercised? | Read, write, approval and export events | No use, limited use or material action |
| Did the package change? | Version, hash, workflow and provenance | Unchanged, changed legitimately or unauthorised change |
| Is re-release still supported? | Combined access and package evidence | Continue, restrict, quarantine or escalate |
5. Define recurrence signals and response ownership
Useful signals include a retired claim reappearing, an entitlement mismatch persisting beyond the approved propagation window, a destination role without a valid authority source, access after a leaver event, unexplained archive reads, or a package action that cannot be linked to an approved identity. Each signal needs an owner and an attached response.
A signal can justify immediate containment before full attribution. Disable or quarantine the narrow affected path, preserve tokens and logs, protect the controlled package and keep unaffected work moving under the released design. Avoid broad deletion or unsynchronised manual fixes that remove the evidence needed to locate the earliest faulty authority.
6. Worked example: contractor renewal revives a legacy acquisition claim
A contractor was correctly released after an acquisition migration: source identity active, current project claim present, legacy acquisition claim retired, workflow reviewer role valid and archive access limited to the current project. Thirty days later, an automated renewal template reintroduces the legacy claim. The federation passes it, and the archive maps it to a broad read group. The workflow application ignores that claim and remains correct.
The nightly cross-system reconciliation detects the archive mismatch. The team quarantines archive access for the identity, preserves the assertion and access logs, and confirms that no write or approval action occurred. The scientific package hash and workflow history are unchanged. Repair begins at the renewal template, then the federation and archive are reconciled before a limited entitlement re-release.
| System | Expected state | Observed state | Decision |
|---|---|---|---|
| Authoritative directory | Current project only | Legacy claim revived by renewal | Repair earliest authority |
| Federation | Pass approved current claim | Passes both current and legacy | Invalidate and reissue after repair |
| Archive | Current-project read | Broad legacy read | Quarantine affected path |
| Workflow | Current reviewer role | Correct | Keep under heightened monitoring |
| Package evidence | Known version and hash | Unchanged | No fabricated scientific-change claim |
7. Repair the earliest authority and reconcile downstream state
Fix the earliest system that incorrectly authorises the entitlement, then propagate and independently verify the correction. Removing only the archive group would treat the symptom while the directory and federation continue to recreate it. Conversely, repairing the source without invalidating a long-lived assertion can leave effective access in place.
Reconciliation should compare expected and effective state at every boundary. Record token invalidation, synchronisation completion, destination group removal, local-account checks and archive permission recalculation. Re-release only after the evidence chain shows both cause repair and downstream convergence.
8. Set fifth-escalation gates
A fifth escalation is appropriate when recurrence crosses systems, affects material authority, cannot be bounded confidently, persists after the expected repair interval, compromises evidence continuity or reveals that the re-release assumptions were wrong. The escalation should name the affected scope, current containment, evidence gaps and authority for reopening access.
Do not escalate merely because one expected synchronisation is still inside its declared delay. Do not avoid escalation because the package appears unchanged when access authority is materially uncontrolled. The gate combines access consequence, recurrence mechanism and confidence in containment.
- Recurrent or orphaned entitlement is independently verified.
- Affected identities, systems, packages and authority are bounded or explicitly unknown.
- Containment protects controlled work and preserves evidence.
- Package use and change are investigated separately.
- Recovery, re-release and residual-monitoring authority are named.
9. Use a staged re-release after recurrence
After repair, begin with the smallest entitlement that supports the required task. Exercise the lifecycle event that caused recurrence, verify claims at every boundary and observe token renewal, archive mapping and workflow decisions. Expand only when the same evidence remains coherent through relevant synchronisation cycles.
Keep the quarantine capability ready and test the rollback. A successful ordinary sign-in is weak evidence if the failure appeared only at renewal or project transfer. The re-release trial must include the triggering mechanism, not merely the calm state after it.
10. Maintain evidence continuity through operational repair
Preserve the original fourth re-release record, the recurrence event, containment actions, repaired configuration, validation evidence and fifth-escalation decision as linked records. Do not overwrite the old entitlement snapshot with the corrected one. A future reviewer must be able to reconstruct what was believed, what changed and why work resumed.
Where logs have different clocks, record the offsets or use a common time source. Where one system cannot export complete history, state the gap and use corroborating records rather than implying certainty. Evidence continuity is truthful linkage, not a claim that every system is perfect.
11. Misconceptions, practical questions and transfer
Common mistakes include testing only login, repairing only the destination, treating a clean package hash as proof that access was acceptable, and deleting the account before preserving evidence. The useful question is end to end: what authority existed, how it propagated, whether it was exercised and whether the controlled package changed.
Does an unchanged file hash close an entitlement recurrence?
No. It is evidence that a particular object did not change, but exposure, unrecorded views, approval authority and other packages still require investigation. Access and scientific integrity are linked questions, not the same question.
Should every mismatch trigger a fifth escalation?
No. Apply the declared propagation window, materiality and containment criteria. A persistent, cross-system, consequential or unbounded mismatch meets a stronger escalation case than a transient state already governed by the release plan.
12. Changed-context evidence check and authoritative sources
Transfer the method to a vendor federation that issues a different subject identifier and refreshes claims at a different interval. Rebuild the boundary map, test renewal and reassignment events, confirm how archive and workflow systems correlate identities, and retain an independent package identifier. Do not assume that the same group name means the same authority across federations.
ICH Q10 Pharmaceutical Quality System describes lifecycle quality management, change management, corrective action and management review. NIST SP 800-53 Revision 5 provides control families for access control, identification, audit and continuous monitoring. These sources support disciplined governance and evidence; local polymer-science procedures, regulated obligations and system facts determine the exact gate.
Continue through the Gold Standard ecosystem
Return to the Polymer Science subject root, the Gold Standard of Education parent, or the How X Works hub.
Immediate predecessor: fourth-escalation recovery and evidence-continuity re-release · Earlier guide: post-re-release entitlement surveillance and fourth-escalation gates · Polymer Science root
These routes are grouped by learning purpose: prerequisite model, immediate predecessor, and the wider transfer framework. They are not substitutes for the evidence and limits stated in this guide.