Turn a collection question into an authorization boundary

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Public activity · 30d

—Participating browsers

—Page views

—Reading sessions

—Exercise opens

Counts reflect browsers that allowed analytics. A reading session requires 30 seconds on a visible page. Browsers are not people.

Day 16 — Turn a collection question into an authorization boundary

Theory and mechanism. A collection contract connects an investigation question to a particular producer, selection rule, permitted operation and receiving role. Its purpose is to prevent a useful question from becoming an unbounded data transfer. Separate what would answer the question from what the analyst is permitted to obtain. An API might expose more fields than the approval allows; an approval might cover data the interface cannot export. Neither condition repairs the other. The NIST forensic-techniques guide gives source-sensitive acquisition context; the contract below is an original supervised workflow, not a NIST form or authorization.

At 09:14, C08 supplies a custodian statement about 10:00 expiry. It does not supply C09's later approval or collection. The bounded question is whether detailed identity records can clarify account/session/client relationships near the reported activity. Request svc-enroll IdP detail for proposed 08:50–09:05 UTC, necessary source event IDs and time basis, session/client/outcome fields, and query/export provenance. A minimal case destination is an access-controlled evidence location whose actual identifier remains to be assigned. Do not invent a storage path, approver's signature or operator receipt to complete the worksheet.

Assumptions and evidence. The time range must name the selected field and timezone, endpoint inclusion, ingestion lag and paging behavior. The existing case's notation does not specify whether 09:05 is included. Mark that as a custodian question rather than silently declaring an implementation. The same caution applies to a shared source object: possessing an export button does not permit transfer of unrelated users' records. Ask the custodian for a filtered export, permitted field projection or restricted in-place review. If the approved method cannot satisfy the question, record the gap and seek an explicit scope amendment.

Worked contrast. “Get every identity log before it disappears” leaves producer, selectors, rights and destination undefined. A defensible alternative states: “Please decide whether the identity custodian may retrieve the proposed bounded selection for CTN-IR-014/IDP-01, with source/query metadata and a restricted receiving role. Confirm interval semantics and access conditions; execution remains pending.” It asks for an actual decision. Writing “approved 09:16” at the 09:14 checkpoint would import C09 from the future.

Consider a separate W4-SCOPE tabletop variant, not the C09 query. Suppose an owner proposes a half-open event-time window [08:50,09:05) and the account selector svc-enroll. A synthetic 08:50 matching-account row is eligible; an 09:05 row is outside this proposed rule; an 08:58 different-account row is also outside. If the latter is needed to test a relationship, the correct next state is a new bounded approval request, not silent query expansion. This tests selection reasoning without performing collection. A filter's returned rows still would not prove producer completeness or authorized execution.

Decision and limit. Record request, approval, collection and receipt separately, including a stop condition if scope or access is unclear. A reported deadline prioritizes owner attention; it does not grant privilege or preserve source data by itself. Permission to export is distinct from permission to retain, disclose or transform an unrestricted copy under local rules.

Practice. Complete EX016 using only C03/C05/C08 at 09:14. Specify the contract, unresolved interval semantics and a conditional response if the interface offers only an oversized export. Compare the worked answer. No source contact or real export is part of the exercise.

Continue studying — course Day 16: Previous: Week 3, Day 15 · Week 4 index · Course index · Next: Day 17.

Exercise for this lesson

EX016 — Bounded collection request. Objective: specify a reviewable request without expanding permission. Input: C03/C05/C08 at 09:14, the earlier role boundaries and Day 16. Produce a contract naming IdP source, proposed 08:50–09:05 UTC range, selected time field and unresolved endpoint semantics, account/field selectors, purpose, custodian, approval gate, restricted receiving role and expected receipt. State a stop/amendment rule if only an oversized export is offered. No C09 approval or real collection is available at this checkpoint. Rubric: 0 = invented permission/execution or unrestricted collection; 1 = bounded request with missing semantics, owner or stop condition; 2 = actionable contract preserving pending authority and explicit scope-change handling. Worked answer.

Practice the exercises

Open a prompt, write your response, then compare it with the worked answer. Five-choice practice appears where a reviewed question is available.

EX016

Open the prompt →Compare with the worked answer →

Opens in 30 days: — · browsers: —

Checking for a reviewed five-choice question…

Worked answers

EX016 — Model request. CTN-IR-014 / IDP-01, requested 09:14: identity custodian to preserve detailed IdP events for svc-enroll, 08:50–09:05 UTC, selecting event ID, original source timestamp/zone, session, client, outcome, account and export/source metadata. Purpose: test whether the summary's session/client fields can be reviewed before C08's 10:00 expiry; limit any other identifiers under custodian policy. Approval gate: identity authority and any applicable case/data owner. Expected result: source object ID, export query, byte count, digest and restricted copy location. At 09:14 these are requested, not received. At 09:16 C09 later supplies an approval, but do not use that to backdate the request's status.

Additional worked reasoning (EX016 — Proposed collection request.): At 09:14 C08 supports urgency to ask the identity custodian for a narrowly scoped 08:50–09:05 svc-enroll IdP detail source, preserving original timestamps, session/client fields, event IDs, producer/copy metadata and an explicit restricted location. Identity/data-owner authorization and actual collector/time are pending, not complete. The purpose is a bounded source availability and correlation question, not “download the tenant.” An actual expiry at 10:00 is a custodian statement in C08, not a blanket data-access permission.

Week 4 Day 16 — worked collection contract. At 09:14 the proposal is IdP detail for svc-enroll, 08:50–09:05 UTC, to examine session/client context around C03/C05. Ask which source time field, zone, endpoint inclusion, ingestion cutoff and paging behavior implement that interval. Minimum relevant fields are source event ID/time/zone, account, session, client, outcome and acquisition metadata. The accepting role is the identity/data custodian under actual case rules; the restricted destination identifier and operator receipt are not supplied. C09's later 09:16 approval cannot complete this earlier form. Expected evidence is an actual decision followed separately by a source-specific collection/receipt record. If the interface offers only all identities, stop the proposed transfer and request an authorized narrower method or amendment. In W4-SCOPE only, [08:50,09:05) includes a matching-account 08:50 event but excludes 09:05 and a different-account 08:58 row. These are selection outcomes in a separate tabletop, not C09's established query or real collection.