#### Day 16 — Turn a collection question into an authorization boundary **Theory and mechanism.** A collection contract connects an investigation question to a particular producer, selection rule, permitted operation and receiving role. Its purpose is to prevent a useful question from becoming an unbounded data transfer. Separate **what would answer the question** from **what the analyst is permitted to obtain**. An API might expose more fields than the approval allows; an approval might cover data the interface cannot export. Neither condition repairs the other. The [NIST forensic-techniques guide](https://csrc.nist.gov/pubs/sp/800/86/final) gives source-sensitive acquisition context; the contract below is an original supervised workflow, not a NIST form or authorization. At **09:14**, C08 supplies a custodian statement about 10:00 expiry. It does not supply C09's later approval or collection. The bounded question is whether detailed identity records can clarify account/session/client relationships near the reported activity. Request `svc-enroll` IdP detail for proposed 08:50–09:05 UTC, necessary source event IDs and time basis, session/client/outcome fields, and query/export provenance. A minimal case destination is an access-controlled evidence location whose actual identifier remains **to be assigned**. Do not invent a storage path, approver's signature or operator receipt to complete the worksheet. **Assumptions and evidence.** The time range must name the selected field and timezone, endpoint inclusion, ingestion lag and paging behavior. The existing case's notation does not specify whether 09:05 is included. Mark that as a custodian question rather than silently declaring an implementation. The same caution applies to a shared source object: possessing an export button does not permit transfer of unrelated users' records. Ask the custodian for a filtered export, permitted field projection or restricted in-place review. If the approved method cannot satisfy the question, record the gap and seek an explicit scope amendment. **Worked contrast.** “Get every identity log before it disappears” leaves producer, selectors, rights and destination undefined. A defensible alternative states: “Please decide whether the identity custodian may retrieve the proposed bounded selection for CTN-IR-014/IDP-01, with source/query metadata and a restricted receiving role. Confirm interval semantics and access conditions; execution remains pending.” It asks for an actual decision. Writing “approved 09:16” at the 09:14 checkpoint would import C09 from the future. Consider a separate **W4-SCOPE tabletop variant**, not the C09 query. Suppose an owner proposes a half-open event-time window `[08:50,09:05)` and the account selector `svc-enroll`. A synthetic 08:50 matching-account row is eligible; an 09:05 row is outside this proposed rule; an 08:58 different-account row is also outside. If the latter is needed to test a relationship, the correct next state is a new bounded approval request, not silent query expansion. This tests selection reasoning without performing collection. A filter's returned rows still would not prove producer completeness or authorized execution. **Decision and limit.** Record request, approval, collection and receipt separately, including a stop condition if scope or access is unclear. A reported deadline prioritizes owner attention; it does not grant privilege or preserve source data by itself. Permission to export is distinct from permission to retain, disclose or transform an unrestricted copy under local rules. **Practice.** Complete [EX016](#exercise-ex016) using only C03/C05/C08 at 09:14. Specify the contract, unresolved interval semantics and a conditional response if the interface offers only an oversized export. Compare the [worked answer](#answer-ex016). No source contact or real export is part of the exercise. **Continue studying — course Day 16:** [Previous: Week 3, Day 15](#week-03-day-05) · [Week 4 index](#ch-04) · [Course index](../SUBJECTS.md) · [Next: Day 17](#week-04-day-02). ### Exercise for this lesson **EX016 — Bounded collection request.** Objective: specify a reviewable request without expanding permission. Input: C03/C05/C08 at 09:14, the earlier role boundaries and Day 16. Produce a contract naming IdP source, proposed 08:50–09:05 UTC range, selected time field and unresolved endpoint semantics, account/field selectors, purpose, custodian, approval gate, restricted receiving role and expected receipt. State a stop/amendment rule if only an oversized export is offered. No C09 approval or real collection is available at this checkpoint. Rubric: 0 = invented permission/execution or unrestricted collection; 1 = bounded request with missing semantics, owner or stop condition; 2 = actionable contract preserving pending authority and explicit scope-change handling. [Worked answer](#answer-ex016). ## Worked answers **EX016 — Model request.** `CTN-IR-014 / IDP-01`, requested 09:14: identity custodian to preserve detailed IdP events for `svc-enroll`, 08:50–09:05 UTC, selecting event ID, original source timestamp/zone, session, client, outcome, account and export/source metadata. Purpose: test whether the summary's session/client fields can be reviewed before C08's 10:00 expiry; limit any other identifiers under custodian policy. Approval gate: identity authority and any applicable case/data owner. Expected result: source object ID, export query, byte count, digest and restricted copy location. At 09:14 these are **requested**, not received. At 09:16 C09 later supplies an approval, but do not use that to backdate the request's status. **Additional worked reasoning (EX016 — Proposed collection request.):** At 09:14 C08 supports urgency to ask the identity custodian for a narrowly scoped 08:50–09:05 `svc-enroll` IdP detail source, preserving original timestamps, session/client fields, event IDs, producer/copy metadata and an explicit restricted location. Identity/data-owner authorization and actual collector/time are **pending**, not complete. The purpose is a bounded source availability and correlation question, not “download the tenant.” An actual expiry at 10:00 is a custodian statement in C08, not a blanket data-access permission. **Week 4 Day 16 — worked collection contract.** At 09:14 the proposal is IdP detail for `svc-enroll`, 08:50–09:05 UTC, to examine session/client context around C03/C05. Ask which source time field, zone, endpoint inclusion, ingestion cutoff and paging behavior implement that interval. Minimum relevant fields are source event ID/time/zone, account, session, client, outcome and acquisition metadata. The accepting role is the identity/data custodian under actual case rules; the restricted destination identifier and operator receipt are not supplied. C09's later 09:16 approval cannot complete this earlier form. Expected evidence is an actual decision followed separately by a source-specific collection/receipt record. If the interface offers only all identities, stop the proposed transfer and request an authorized narrower method or amendment. In W4-SCOPE only, `[08:50,09:05)` includes a matching-account 08:50 event but excludes 09:05 and a different-account 08:58 row. These are selection outcomes in a separate tabletop, not C09's established query or real collection.