Design coverage evidence that can reveal bypass and collateral harm

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Public activity · 30d

—Participating browsers

—Page views

—Reading sessions

—Exercise opens

Counts reflect browsers that allowed analytics. A reading session requires 30 seconds on a visible page. Browsers are not people.

Day 29 — Design coverage evidence that can reveal bypass and collateral harm

Learning task. Define a coverage verdict using named routes, opposite controls and authoritative observations. The denominator is an owner-reviewed inventory of in-scope mutation paths, not the number of tests that happened to pass. A test should bind target slot, operation, route, allowed window, request identifier, expected outcome and observation source. A response code alone may describe front-end rejection while an asynchronous writer later commits; authoritative state/version and audit observations are needed to test that possibility. State what each observation actually measures rather than assuming every layer agrees.

For a hold, a negative S42 write test asks whether the protected operation was rejected without a committed change. A positive permitted S40/S41 check asks whether legitimate service remains available. “Negative” refers to the operation expected to be rejected; a bypass is a negative test result for the security property. Both axes matter. Passing service checks cannot compensate for an accepted S42 mutation; rejecting every request is not a business-preserving success. Real test design requires explicit owner permission and safe synthetic inputs. Here all inputs are offline or already supplied observations.

Worked V6 verdict. The isolated variant supplies a browser-form S42 denial, a direct API S42 acceptance and a successful S40 control. Its claimed all-route S42 property fails because one supplied in-scope route accepts the prohibited operation. The successful browser and S40 outcomes do not cancel the bypass. Ask the application owner where the guard predicate is enforced and whether the form and API share that boundary. A proposed retest needs a reviewed inventory, authorization, one protected-operation denial and permitted-service check per applicable path, observation receipts and a stop rule for either bypass or collateral harm. V6 does not prove a CTN bypass: C19 supplies only one observed CTN application route.

Contrast. “One of one observed S42 routes passed, so coverage is 100%” silently changes the denominator from all routes to observed routes. “One of two V6 routes failed, therefore CTN is 50% contained” combines two different fixtures and invents a meaningful risk fraction. Report separate scope-qualified verdicts instead: CTN other-route coverage unknown; V6 all-route criterion failed. A route not tested is unknown, not denied and not accepted.

Offline laboratory review. Run the retained C6X program in §6.15 and reproduce its seven lines. C16 gives PROPOSED_ONLY; C17 APPROVED_NOT_APPLIED; C18/C19 COVERAGE_UNKNOWN. The separate invented BYPASS row gives PROTECTION_FAIL; SERVICE_DOWN gives BUSINESS_FAIL; LAB_PASS gives BOUNDED_TEST_PASS. Read the function: it expects form and api, and a single legitimate outcome. Those are declared fixture inputs, not an owner-discovered CTN inventory. The function checks the reported approval/application ordering but does not authenticate roles, check expiry, require independent receipts or test each legitimate slot. W6-TIME covers only a separate interval calculation; combining two toy passes still does not verify a real application.

Paper adverse control W6-MISSING. Start with LAB_PASS's two supplied route denials. Add a hypothetical owner-declared third route worker with no observation. A defensible coverage ledger now has two observed denials and one unknown row, so it refuses an all-route verdict. Do not merely change C6's arbitrary threshold to three and count dictionary entries: duplicate names, stale observations or wrong target slots would still mislead. Next replace the worker's missing result with an accepted S42 mutation in the isolated worksheet; now the protection criterion fails. Neither row becomes C19 or authorizes a live test. This exercise teaches why inventory completeness and evidence validity precede arithmetic.

Practice and limits. Add columns for source, request, time/window, target, route, commit/state observation and service result to your proposed verification sheet. Mark fields unavailable in C19 rather than inventing them. Begin EX029 and its worked rollback card: translate bypass, service regression and expiry into three distinct owner-governed triggers, leaving actual reversal pending. Rehearse V6 for the next day's EX030. Unknown coverage requires a time-bounded owner decision, not indefinite silence or a false pass.

Previous: Day 28 · Week 6 index · Course index · Next: Day 30.

Exercise for this lesson

EX029 — Conditional rollback. Objective: translate coverage and service failures into an owner-governed reversal plan. Inputs: C17–C19, Day 29 coverage design and Day 30 expiry synthesis. Write a card with scope/configuration, decision and operator roles, three distinct triggers (expiry, bypass, service regression), preserved sources and proposed pre/post-action checks. Explain why bypass may require re-planning rather than automatic removal of a partial guard. Leave actual reversal/renewal receipts and results pending; use no later card. Rubric: 0 = invented rollback/extension or unauthorized expansion; 1 = useful triggers but missing source, authority or exposure/service checks; 2 = actionable conditional card preserving the fixed boundary and all missing results. Worked answer.

Practice the exercises

Open a prompt, write your response, then compare it with the worked answer. Five-choice practice appears where a reviewed question is available.

EX029

Open the prompt →Compare with the worked answer →

Opens in 30 days: — · browsers: —

Checking for a reviewed five-choice question…

Worked answers

EX029 — Model rollback card. Owner: application operator under service-owner and incident-lead decision. Triggers: approved 09:47 expiry without extension; evidence of an unguarded S42 write or unexpected S40/S41 denial; a legitimate enrollment impact above the owner-approved tolerance. Before rollback, preserve C17–C19 approvals, receipts and selected audit records under their custodians. On a triggering decision, operator would record configuration version, change time and authorization, then verify S42/S40/S41 behavior and monitor for renewed edits. No actual rollback is in C17–C19; an answer must leave execution and result blank. C21 later supersedes the expiry through a new approval, but cannot be presumed at the EX029 checkpoint.

Additional professional worked reasoning: The expiry at 09:47 is an escalation/reversal trigger from C17, but the chapter has no actual rollback execution receipt. A bypass on a declared write route, unexpected S40/S41 denial, or service harm outside accepted tolerance also requires a new owner-led decision. Preserve source and operator evidence, then conditionally test post-action S42 protection and permitted enrollment behavior; resumption or renewal cannot be inferred from a clock alone. No privileged command is to be run by the learner.

Week 6 Day 29 — worked conditional trigger card. Reference C17's S42-only scope, g-22 as reported by C18, designated application operator/rollback role and owner/incident-lead decision capacity. Preserve approval, operator and relevant audit sources before a contemplated change. Trigger one: 09:47 automatic expiry without new approval, followed by actual-state and exposure/service checks. Trigger two: observed bypass, requiring urgent owner review because removing a partially protective guard might worsen risk and broadening it needs authority. Trigger three: unexpected S40/S41 denial or accepted-cost breach, requiring the designated decision/reversal procedure. Proposed checks include configuration and observation time, protected-path behavior, legitimate service and queued-work reconciliation where applicable; unavailable observations stay unknown. Actual reversal, renewal and post-action outcomes remain pending. Reverting a guard is not restoring an 08:30 data snapshot.