Recorded native execution · October 2, 2026

Application access assurance

A valid login.
A revoked permission.
A finding you can trace.

SignalBridge detected a deliberately introduced flaw that let a removed member read a private document. Follow the actual request, source event and investigation from the isolated reference lab.

Follow the evidence ↓ Inspect the published data
2 isolated business applications
23 / 23 source events processed
1 R3 investigation opened
31 HTTP control observations

A finite synthetic lab run. These counts describe this execution; they do not measure detection accuracy or production scale.

Source apps Documents + expenses
Atomic write Permission + outbox
Transport Signed HTTPS events
Correlation Removal + allowed read
Analyst console Evidence-linked case

The document investigation

One account, one private resource, five decisive steps.

Each step below comes from the retained execution. Expand a record to see the event identity and source fields. This page reads saved evidence; it does not simulate new requests or claim the lab is running.

01

Establish legitimate access

A member reads the known private document. This positive control establishes that the app and record work.

HTTP 200 private_record.read allowedKnown private content confirmed
Inspect the recorded event · 81d7aa57 
{
  "event_id": "81d7aa57-abd6-41ac-a68e-572224465b38",
  "app": "documents",
  "digest": "e64b869672c5450de3133bfb2c7d8b821f599123b4b8168cb8b839925592aa9c",
  "source": "instrumented_lab",
  "processed_at": "2026-10-02T23:48:54.387144+00:00",
  "state": "processed",
  "operation": "private_record.read",
  "actor": "a56abc50f2129848b5146e424009481c21149263c07dd72cf531a812672ad0b3",
  "resource": "28543363586bf34931f7dcfe886fb8104166c711e48ff2e2b680d5ebe2df14e0",
  "outcome": "allowed",
  "reason": "member",
  "occurred_at": "2026-10-02T23:48:40.341793+00:00",
  "membership": null
}
02

Remove effective permission

The application commits the permission change and its telemetry together. The account’s existing session is still valid.

HTTP 200 membership.change allowedEffective access removed
Inspect the recorded event · 72d34194 
{
  "event_id": "72d34194-5462-465c-9169-5a2c92ab8e48",
  "app": "documents",
  "digest": "bde6ecd6970d353a5469773bc9499bc0415126c78276551c47d40928a680f2ce",
  "source": "instrumented_lab",
  "processed_at": "2026-10-02T23:48:54.436518+00:00",
  "state": "processed",
  "operation": "membership.change",
  "actor": "7d7c436375ddc8cbc8dc9f55c791a8d905a14d495e9baf702fa8f224ff2b5226",
  "resource": "28543363586bf34931f7dcfe886fb8104166c711e48ff2e2b680d5ebe2df14e0",
  "outcome": "allowed",
  "reason": "membership_removed",
  "occurred_at": "2026-10-02T23:48:40.529593+00:00",
  "membership": {
    "state": "removed",
    "subject": "a56abc50f2129848b5146e424009481c21149263c07dd72cf531a812672ad0b3"
  }
}
03

Observe the intended boundary

The same session receives HTTP 403. The owner still receives the known document: the service is available.

HTTP 403 private_record.read denied
Inspect the recorded event · 2e3e6ab9 
{
  "event_id": "2e3e6ab9-af04-4b70-a1e3-6af40051eaca",
  "app": "documents",
  "digest": "0a8da0412ce30e684e05af097cb0b9df11e8b527d79b02d34a120b2de723154a",
  "source": "instrumented_lab",
  "processed_at": "2026-10-02T23:48:54.449731+00:00",
  "state": "processed",
  "operation": "private_record.read",
  "actor": "a56abc50f2129848b5146e424009481c21149263c07dd72cf531a812672ad0b3",
  "resource": "28543363586bf34931f7dcfe886fb8104166c711e48ff2e2b680d5ebe2df14e0",
  "outcome": "denied",
  "reason": "membership_required",
  "occurred_at": "2026-10-02T23:48:40.641928+00:00",
  "membership": null
}
04

Detect the deliberately introduced flaw

The bounded lab defect allows the removed member to retrieve the known private document. R3 joins this read to the removal event and opens one investigation.

HTTP 200 private_record.read allowedKnown private content confirmed
Inspect the recorded event · 9cb9a004 
{
  "event_id": "9cb9a004-9f54-4c87-8740-cdb52b91c99f",
  "app": "documents",
  "digest": "d346c5f5f4262907e0b2a247202b7b3a2bbc67d498a71c355d3cbbfa3d393cf6",
  "source": "instrumented_lab",
  "processed_at": "2026-10-02T23:48:54.470633+00:00",
  "state": "processed",
  "operation": "private_record.read",
  "actor": "a56abc50f2129848b5146e424009481c21149263c07dd72cf531a812672ad0b3",
  "resource": "28543363586bf34931f7dcfe886fb8104166c711e48ff2e2b680d5ebe2df14e0",
  "outcome": "allowed",
  "reason": "member",
  "occurred_at": "2026-10-02T23:48:42.417343+00:00",
  "membership": null
}
05

Reset and verify the controls

After the defect is reset, the member receives HTTP 403 and the owner still reads the document. Re-granting permission then restores legitimate access.

HTTP 403 private_record.read denied
Inspect the recorded event · 05ff290d 
{
  "event_id": "05ff290d-15c0-444c-af76-108ccebc0a6d",
  "app": "documents",
  "digest": "573c7c6c6c9ae06f2a08f21f78f2d1121d57e374de3fa14a477b0b01ce97684c",
  "source": "instrumented_lab",
  "processed_at": "2026-10-02T23:48:54.484585+00:00",
  "state": "processed",
  "operation": "private_record.read",
  "actor": "a56abc50f2129848b5146e424009481c21149263c07dd72cf531a812672ad0b3",
  "resource": "28543363586bf34931f7dcfe886fb8104166c711e48ff2e2b680d5ebe2df14e0",
  "outcome": "denied",
  "reason": "membership_required",
  "occurred_at": "2026-10-02T23:48:44.181396+00:00",
  "membership": null
}

HTTP 200 alone would be insufficient. The source control separately confirmed that the response contained the known synthetic private record. The unchanged session was also checked independently.

Why this became an investigation

Correlate evidence. Don’t trust a “suspicious” label.

The finding

R3 links the authoritative effective-removal event to an allowed read by the affected account, within the same application, resource and declared time window.

The source labeled the later read allowed / member. SignalBridge found the conflict by joining the observations.

Case 1576faa9-6deb-4511-804c-81dafa8bb648
Rule R3 · Priority high
Recorded disposition: open

The controls that make it credible

  • The removed member’s session still worked; login failure did not explain the denial.
  • The owner could still read the document; a broken service did not explain the denial.
  • Cross-app accounts and outsiders were denied in both apps.
  • Re-grants and alternate grants preserved legitimate access.
  • The bounded defect was reset, followed by denial and owner checks.

Restoration was observed. The case remained open in this run: no human analyst decision or independent remediation approval is claimed.

Browse all 23 processed source events
documents · private_record.read · allowed 2026-10-02T23:48:40.341793+00:00 · member 81d7aa57-abd6-41ac-a68e-572224465b38
documents · private_record.read · denied 2026-10-02T23:48:40.406163+00:00 · membership_required e1a6515a-3d57-44b5-8860-85bf4fd82ea3
documents · private_record.read · denied 2026-10-02T23:48:40.466112+00:00 · membership_required f79ed90c-6c27-4931-8acb-c9d0ed3f5b61
documents · membership.change · allowed 2026-10-02T23:48:40.529593+00:00 · membership_removed 72d34194-5462-465c-9169-5a2c92ab8e48
documents · private_record.read · denied 2026-10-02T23:48:40.641928+00:00 · membership_required 2e3e6ab9-af04-4b70-a1e3-6af40051eaca
documents · private_record.read · allowed 2026-10-02T23:48:40.699895+00:00 · owner 5e352674-4ccf-43b9-a6bb-76a1d645f7c1
documents · private_record.read · allowed 2026-10-02T23:48:42.417343+00:00 · member 9cb9a004-9f54-4c87-8740-cdb52b91c99f
documents · private_record.read · denied 2026-10-02T23:48:44.181396+00:00 · membership_required 05ff290d-15c0-444c-af76-108ccebc0a6d
documents · private_record.read · allowed 2026-10-02T23:48:44.242503+00:00 · owner 7a531e45-e252-40bc-981e-9e04b4f03ad7
documents · membership.change · allowed 2026-10-02T23:48:44.307883+00:00 · member 39fb97e4-5f1c-4a81-baa4-55e34fe728aa
documents · private_record.read · allowed 2026-10-02T23:48:44.366120+00:00 · member 28e7e223-008c-4cce-9265-189e02efa1fc
documents · private_record.read · allowed 2026-10-02T23:48:44.554172+00:00 · member 9327fd20-f91e-45d8-863c-4b980ec07426
expenses · private_record.read · allowed 2026-10-02T23:48:44.747458+00:00 · member 65ded984-875f-4ac9-8a55-edaa11440808
expenses · private_record.read · denied 2026-10-02T23:48:44.807541+00:00 · membership_required 1c8e6158-3fd1-4ab4-bed2-f6a2dba23dc8
expenses · private_record.read · denied 2026-10-02T23:48:44.867417+00:00 · membership_required 32ce1137-045d-4519-ad34-082d2b320e8e
expenses · membership.change · allowed 2026-10-02T23:48:44.929006+00:00 · membership_removed 6046b9d7-aaa2-4b8b-9d85-bc70ea6f7fc5
expenses · private_record.read · denied 2026-10-02T23:48:45.050440+00:00 · membership_required 92835e9e-3839-4f46-a0ad-5e355878ef90
expenses · private_record.read · allowed 2026-10-02T23:48:45.108426+00:00 · owner f3af4151-0059-490e-85d1-11f13069ce4f
expenses · membership.change · allowed 2026-10-02T23:48:45.175635+00:00 · member 02164679-39a8-4914-a23d-39dd16dde27a
expenses · private_record.read · allowed 2026-10-02T23:48:45.233669+00:00 · member 4d62ee91-132b-42b7-98c4-89e0fa0bf18d
expenses · private_record.read · allowed 2026-10-02T23:48:45.424698+00:00 · member df47df72-f4f2-4a57-8b91-b2bb814fde71
documents · private_record.read · allowed 2026-10-02T23:48:47.647409+00:00 · member e6c667f8-a18e-4cd1-9725-9eda50deaf27
expenses · private_record.read · allowed 2026-10-02T23:48:47.712935+00:00 · member 48818336-7d00-4d69-8957-dce17027e3fa

WAZUH · RETAINED INCOMPLETE EXECUTION

A running tool is not proof of delivered evidence.

0 / 24 inputs collected

The later enterprise collector started its native processes, but none of the frozen source inputs reached the archive. The integration failed its acceptance check.

This result is separate from the earlier successful 64-event Wazuh pilot in the evidence library.

The finding changed the design

On its first start, the collector began at the end of the preloaded file. The launcher was retired. A different approach starts with empty monitored files, verifies readiness, then publishes the fixed events.

That replacement has no successful native execution yet.

Read the failure and shutdown record

Run 009bc11e4fe649649d7dd44887be8b72 ended 2026-10-03T01:20:15.581890+00:00.

Both shutdown receipts reported the container stopped. The independent shutdown recorded a control error; the overall acceptance gate failed. These are historical records, not current machine-health claims.

Original incomplete execution receipt · Retained diagnosis and source reference

Engineering you can inspect

More than a detection screenshot.

What ran

Real login and HTTP requests against two database-backed reference applications, a transactional telemetry outbox, signed ingestion, a processing worker and an R3 case. The isolated run used PostgreSQL and explicitly trusted temporary TLS certificates.

Both application scopes reconciled: 13 document events and 10 expense events. Both shutdown checks passed; the containers were stopped.

Read the native execution receipt →

What connects next

23 minimal observations and one SignalBridge-generated finding were staged for Wazuh. The source run staged those packets; the later collector attempt and its failure are recorded above. A forwarded finding is not independent Wazuh rediscovery.

The existing evidence library contains the earlier genuine Wazuh and ZAP pilots. Continuous enterprise collection, authenticated ZAP, native Keycloak/MFA and Shuffle remain unfinished.

Inspect the earlier tool executions →

Why it matters

Removing access isn't the same as ending it.

The risk

A user can stay signed in after losing a permission. I wanted to show that monitoring can catch a private read that contradicts an authoritative access change.

What this run shows

In this isolated lab, the removed account read a known private record under a deliberate defect. Resetting the defect restored the denial, and the owner's access kept working.

Evidence boundary

Native run: b8667b816ce8419da7f3d5d9ac9d6ad6
Executed source SHA-256: 6a0b6fb937544bb51fa673b34cb99a0cd5f522f3ac84871c609c379a89ff1471