## Chapter 15 — A platform secret is not an empty config row ### Lesson map Lesson 15. Map, example, EX061. ```mermaid flowchart TD C["booking-app-config at admins"] --> R["Sensitive, and not in bad"] S["Password moved and changed"] --> P["Prose about the platform setting"] R --> Q{"Does the passing row prove the file is empty?"} P --> Q Q -->|No| K["The row and the prose stay separate"] ``` A passing triple does not describe the bytes inside the object. ### Logical drawing ```text triple: booking-app-config , admins , True prose: database password moved to platform secret settings, then changed absent: the password, a Secret object, a statement that the file is empty ``` ### Learning outcomes After this chapter, you should be able to: 1. Read the config triple as a sharing result. 2. Keep the password move in prose. 3. Refuse both a printed secret and an emptiness proof. ### 15.1 The row answers a sharing question only. `booking-app-config` is `True` and `admins`. `admins` is a member of `allowed[True]`, so the comprehension does not print the name. The triple does not say what bytes are inside the object. The prose says the developer moved the database password into the platform's secret settings and then changed it, because the old value may already have been copied. That paragraph is not loaded by the filter. `staff` and `admins` are equal in the set test. Calling `admins` narrower is a human gloss. The program would also have accepted `staff` for this sensitive object. Kubernetes documents good practices for Secret objects. This platform is not a Kubernetes cluster, and no Secret manifest is in the file. The guidance is an analogy for keeping a value out of an image, not a result printed for Oakfield. The password is not written here. `old-backup.zip` is a separate triple, described as a copy from the previous system. This chapter does not claim the zip contains the booking password. Copies of a configuration file are the prose concern in the password paragraph; the zip's contents are not itemised beyond that earlier description. ### 15.2 Worked example | Claim | What would show it | Decision | |---|---|---| | The config triple passes | `admins` is allowed | Keep | | The password was moved and changed | Prose | Keep, value unprinted | | "The passing row proves the file no longer holds the password." | The triple has no content field | Reject | | "admins is computed as stricter than staff." | Both are mere members | Reject | > **Synthetic case.** No password characters appear in the book. ### Errors and limits Do not fill the blank with an example secret. The absence of a value is the point. ### Apply - **EX061 — Row versus move.** A note says the passing config row proves the password is gone, prints a sample password, and says `admins` outranks `staff` inside the program. What do you reject, and what stays? *Rubric:* 3 = reject the emptiness proof, the sample, and the ranking; the triple stays sensitive, `admins`, and out of `bad`; the move and the change stay prose;; 2 = the row stays and the secret stays unprinted;; 1 = one point;; 0 = none. ### Continue studying — lesson 15 (chapter 15 of 20) [← Chapter 14](#ch-14) · [Course chapter index](../SUBJECTS.md) · [Chapter 16 →](#ch-16) Continue to the next authored lesson. ## Worked answers **EX061.** Reject an emptiness proof, a sample password, and a ranking of `admins` over `staff`. The config triple stays sensitive, set to `admins`, and out of the failure list. The move and the password change stay prose.