Proving it stayed closed

A change that landed on Tuesday is a change. It is not yet a close that stayed. Sync runs overnight. A pipeline runs at the top of the hour. Someone who was surprised puts the membership back. A second policy still excludes the account. A secret in a variable group still authenticates, and the permission you thought you revoked is in the manifest the pipeline applies. The ticket is closed because the engineer finished the tasks on the ticket. The morning test does not read ticket status. This chapter is the date to look again, and the habit of repeating it until the verb stopping is a fact rather than a memory of a change window.

The recount is the same test, not a new method

On the date written on the change, the owner of the fourth statement, or the deputy, runs the morning test against the same verb and the same identifiers. No new approval. No incident declared. Does the verb succeed. The answer is yes or no or unknown. Unknown means you could not see the object, not that you are feeling optimistic. Optimistic unknown is how closes become folklore.

Use the identifiers from the sheet, not the display names the change might have tidied. Names lie, and they lie again after a remediation, because remediation is when people rename things to look finished. On the Billing- Readers row the group is now called Billing-Readers-Controlled. The principal's display name gains a suffix. The object id is the same, or the object was deleted and a new one now holds the verb. Both outcomes matter, and only the identifier plus the resource list will show the second. A new principal with the old permission is not a survivor of the old row. It is a birth. Births count as the verb succeeding. Do not file them under "new requirement" without the morning test.

If the change only renamed the group, the reset still succeeds. If the application role is gone, and still gone after sync, the verb fails the morning test.

Read every object that was in the change, and read the watch-items that were ways back in. The on-premises group, after sync. The pipeline run, after a deploy. The second secret, by a look at the resource's credential list rather than a provocative login. The second Conditional Access policy. The access package that provisions from the governance platform. The resource access list, in case inheritance or a direct assignment on the resource was never in the directory group you edited. The identity-side removal can look perfect while the key vault policy still names the principal.

Write the result in the fourth statement, which has been waiting in "changed, awaiting recount". If the verb fails the morning test, the statement becomes: this verb does not succeed, as of this date, because these objects are gone or gated, checked by this person. If the verb succeeds, the statement becomes: the close did not hold, the winning description is still this, the path back was this. Both sentences are successes of the chapter. Only one of them is a success of the close. Programmes that can only write the first sentence will hide the second until the recount is theatre.

Do not celebrate on the day of the change. The recount date exists so that at least one cycle of the things that undo closes has a chance to run. Match the date to the chain. A chain you do not understand well enough to pick a date is a chain you were not ready to close. If the chain was never named, the recount's unknown is the finding, and the verb goes back on the short list until it is.

The ways back in are checks, not a new theory. Hybrid drift: a screenshot of the cloud group at the moment of removal is early, so read the source after the schedule has run. A permission that outlives the credential: read the assignment list, not the expiry. If the change only named the secret, say so. The manifest in source control is an object. If it still declares the per mission, the next deploy is a regrant. The mint behind a short-lived token belongs in the same check.

The exception that grows back. You deleted an exclusion. A failed login or a frightened administrator adds it again, wider, and files no ticket because it was an emergency. The check is the policy export on recount day, compared to the export you saved. If the exclusion is back, the who of that restore goes on the row. It is often the person the close hurt, which means the three lines beside the change failed or were never given. That is operational news. Fix the path they needed, or the exclusion will return every time the path hurts.

The campaign and the access request that re-provision. A reviewer approves a ghost. A request workflow, still armed, grants the entitlement because the model still includes it. The check is whether the model can still create the object. If you have no safe way to see whether provisioning is armed, write unknown, and do not brief the model as harmless. Unknown provisioning is a loaded tool. Loaded tools are not closed.

The copy you marked unknown. The recount does not magically find a second secret. It repeats the look: manifests, variable groups, the configuration. If you still have not looked, the close is provisional. Provisional is an allowed word for one interval. It is not allowed to graduate into closed because the interval was busy.

Report-only is not a stayed close. If the "close" was turning on a workload policy in report-only, the verb still succeeds. The workload limit still decides which principals the feature can see. A recount that shows "policy on" without showing mode and principal class has been sanded into a control story. Open the policy. Read the mode. Then run the morning test anyway, because a policy can be enforced and mis-aimed.

A count, repeated

One close, recounted once, is a case. The next month is where it becomes a practice. Recount the same verb again. Add any new principal or membership the neighbourhood grew that grants the same verb. The estate does not owe you stability. A ratio that only watches the identifiers you had on close day will go green while a pipeline creates the neighbour of the thing you removed.

The count to brief is small, and it belongs in the monthly brief. Verbs on the short list that still succeed. Verbs you closed that stayed closed on the last recount. Verbs you closed that reopened, with the path back named. Three numbers, each with a denominator you can point at. No trend line until you have three recounts, or the line will be a story about two points. Give the three numbers and the date of the next look. A date in the future is the practice. A trend line without a next date is a souvenir.

Keep the evidence pointers from before and after. The working is the identifier, the test, the date, and the name of the person who looked. A dashboard tile labelled "remediated" with no pointer is the catalogue absorbing the close. The tile can exist if a programme needs a picture. The sheet remains the place the fourth statement lives.

If nothing reopened and the verb still fails the test, say nothing reopened. The sentence is allowed to be dull. Dull recounts are the goal. A practice that needs a story every month will eventually invent a near miss. You do not need the near miss. You need the test.

The test of the recount is whether the deputy, with the sheet and no speech from you, can produce the same yes or no. The sheet already contains the identifiers, the verb, the watch-items, and the last evidence pointers. The deputy opens those and writes a new line under the old one rather than editing the old line into smoothness. History of the statement is the proof.

The look has to be nameable in the words the estate actually uses. The cmdlet for app roles. The place the sync rule is read. The pipeline definition path. The policy export. "Check for drift" is a conclusion, not a look. If the look requires a privilege the deputy does not have, name the person who does, and make the recount a two-person hour rather than a fiction of self-service. Proof that depends on an access the prover lacks will be skipped, and skipped proof returns you to ticket status. This is the month the deputy earns the name.

When the deputy and the owner disagree on whether the verb succeeded, believe the stricter reading until you have looked together at the object. Disagreement means the test is ambiguous, and an ambiguous test will be passed by optimism when you are busy. Tighten the verb until the ambiguity goes. "Administer the subscription" is ambiguous. "Assign the role that can read the payment keys, on this subscription" is a test. You may find that the original close used the ambiguous wording and removed the wrong thing. A close of the wrong verb, perfectly recounted, is a precise miss.

Record where the time went, in one sentence. If a recount of one verb takes a day because every look is a hunt, the extract is what you may automate, and the end of this chapter says so. If it takes a day because you are re-deciding what the verb means, the judgment is what you must not hand to a rule. Those two days feel the same from the outside and they are not.

Stayed closed is not became compliant

Compliance language will try to collect the recount. The verb is mapped to a control, the control is marked effective, the effectiveness is sampled next audit. Effectiveness, in that usage, often means the control operates as designed, and the design may be the catalogue. Your recount means something ruder. The action does not succeed on an ordinary morning, or it succeeds only inside a window you opened on purpose and saw close. A win dow you did not watch close is not a stayed close. Go and see the end of one real window before you generalise. Configuration is the change. The ended window is the proof that requested access is still requested.

Notice gets a recount of its own only if you claimed it. If the close depended on "we would know", test that you would know, once, with a use you control, or stop claiming it. An untested alert sits beside the close as a hope. Leave it out of the fourth statement. A statement that says the verb is gone and that you would notice if it returned, when you have checked neither the return path nor the notice, is two hopes. The recount is allowed one result.

There is a close that "stays" only because nobody has needed the verb. The object is gone and the forces have not pushed. That is still a pass of the morning test, and you should not describe it as a test of the watch-items. Say which watch-items had a chance to fire. A sync that did not run is not a sync that held. Read the thing that would regrant. You do not always need to invite the regrant into production to know it is loaded.

When the first verb has stayed closed across two recounts, you may pick up the next verb on the short list, or the next neighbourhood, under the rules you already have. Not the place the connector is healthiest. The count does not reset. The brief says: in the first neighbourhood, this verb stayed closed; this other verb reopened by this path; we are now looking at a second cut. A reset count is how each new area of attention gets a fresh green and the old reopen is archived. Archives are where failed closes go to become design. Keep the reopened row in the monthly three numbers until it is actually closed and recounted, or until it is an acceptance with a name. Those are the only two exits from the number.

If a second neighbourhood's discovery is used as the reason to stop recounting the first, the practice has already died. Discovery and proof are both du ties of the same owner. The question this chapter serves is whether the thing you closed is still closed.

Done, in the ticket tool, means an assignee clicked. Done, in the sheet, means the test failed to find the verb succeeding, on a date, by a named person. Do not join those words. A picture from the change window is evidence of a moment. The moment is not the schedule. Take another on recount day. A clean campaign is consistent with a stayed close and consistent with a close that never touched the winning description. A control identifier next to the row is a compliance activity. If an auditor wants the mapping, give it after the recount, not instead of it. Give them a verb, a before, an after, and a date.

A reopen that becomes an ownerless acceptance has laundered a failed close into paperwork. A living name, a verb, a date, the design pile rather than the word temporary. The owner of the fourth statement should prefer a visible failed close.

A system-assigned identity that died because the resource died should be absent for that reason, and the recount should say the resource is what ended, so nobody thinks you removed a permission you merely buried. A user-assigned identity you detached from one resource may still be attached to another, with the verb intact. Recount the attachments. Sharing was the point of that identity class. If you removed an agent's permission and the permission is still absent, say that. If a new agent appeared with the same permission set, the close of the old row held and the estate grew a new row. That new row is the force of speed. Put it through the harm question before you treat it as the same ticket.

If the recount shows the verb still succeeds, do not open a second change in the same hour and call it iteration. Sit with the path back until you can say it. What we removed. What still grants the verb. Which watch-item it rode in on. What the next change must include that the last one did not. The same verb stays at the top. It is not a reason to switch to a guest-account cleanup so the month still shows movement. Tell the sponsor the reopen in the same brief as the original close. The owner who reports their own reopen keeps the duty.

A missed date is how proof dies while the programme reports delivery. Say the date was missed. Put a new one. Do not backfill a story of a look that did not happen. A date that moves in the open, before it is missed, is ordinary planning. The sheet keeps the missed date visible, with the new one beside it.

What you do not automate yet

Someone will offer a rule that writes the sentence. It will look like a workflow, a policy engine, a campaign that decides by itself, or an agent filing the fourth statement from the stacks you have already joined. Automate the drudgery. Leave the sentence alone. The sentence is which story still grants the verb, whether it would succeed this morning, whether the close stayed, and what hurts enough to be next. A rule writes that in favour of the stack it trusts, and the stack it trusts is the catalogue.

Once a neighbourhood has been done by hand, you may export role assignments, app role assignments, nested membership, Conditional Access exclusions, vault accounts, and entitlements, and match them on object identifiers. You may flag a name match for a person, remind the owner that a recount is due, and diff this month's export against last month's so a birth is visible before anyone calls it an exception. Those are extracts and alarms. They do not choose the winning description, delete a row, or accept a risk.

Report-only results, for principals the feature can see, may sit in a column a person reads. The column says what would have been refused. The decision to enforce, and the decision that this principal is in class at all, stays human. A quiet report can mean the noisy principals never appeared. Move to enforce as one change, then a recount. Not a pipeline stage.

Rotate a secret when rotation is what you intend. Do not let the job tick an access review complete. If a workflow does that, remove the tick. The rotation can remain. The review is the permission list, read on a date.

You do not need a new platform for any of this. If a vendor's pane also wants to store the fourth statement, take the export if you must and refuse the record. Copying the sheet into a tool that tidies blanks automates the contamination, not the extract.

A rule asked to write the fourth statement will cling to a field called decision, or grant, or privileged. The winning test is a set of cases: a stale model, expected silence, a local account, a synced source, an application permission with no user in the request. Encode the cases and you are building a shadow of this book, permanently one shape behind, and then trusting it when the new shape arrives. A person can write unknown. A rule will choose a default, and the default will be briefed. The owner has then become a workflow.

Deletion of unmatched rows stays forbidden. The unmatched vault account may be the only credential for a system that still runs. The unmatched principal may be what deploys production. An empty who-cell is not a delete flag. Orphan cleanup aimed at the directory query will miss the non-human rows and celebrate the wrong denominator. Disable-on-last-logon, plus a missing manager, will disable the batch job that never signs in interactively. You will then add an exception so the job lives, and the exception will have no end. Look, then decide, then change a named object.

A pack's score is a judgment you did not make. A flag may appear on the sheet for a person to read. It may not set the short list. Nothing about one verb requires a model to rank it. If the model is offered, ask whether it removes this object or displays a rank.

Auto-approve when nobody answers, or auto-renew because an acceptance once existed, gives a weekend hole a fresh date and skips the morning test. A workflow can remind the owner. It cannot be the owner, and it cannot renew a bound the owner did not touch.

The exit cell stays empty until, for one agent, you have written the permission, the sponsor, what ends it, and who removes the permission when the manifest would put it back. Do not let a lifecycle product fill the cell. When those lines exist for one class of agent, a script may apply that written end. A person still checks a sample. The script does not invent the end.

Do not enforce a policy you have not watched. Watch it against rows you know, change one named object, recount. A pipeline that enforces tenant-wide because a pilot was quiet has scaled a sample you did not choose. The odd jobs, the local account and the synced group, are what break.

A rule that copies a requester, a commit author, or a manager's manager into the owner field will make an orphan count fall and rot the definition of an owner. An owner is someone you could call. An explicit sponsorship field may be copied as a claim, marked platform-asserted until a person confirms it. Correlation is not that claim. Keep both columns. Do not brief them as one cell because a workflow mapped them.

Write the refusal in the same monthly brief as the three recount numbers, or a helpful build will arrive as a gift you then have to unpick. Extracts may do what this section has already allowed. The decisions that stay with the owner are the winning description; the state, where the morning test is not obvious; whether a limit is real or an excuse; the short harm list; the single first close; the recount; the refusal to delete an unmatched row; the refusal to renew an exception whose owner stayed silent. The slogans will change.

The moves are stable: make the governance platform the source of truth, disable orphans on a schedule, auto-enforce whatever was quiet, renew acceptances, fill the owner from the last commit, mark the review done when a secret rotates, hand the agent to a vendor lifecycle. If you cannot name the verb a proposed rule would break, the rule does not get the keyboard.

A refusal that lapses because someone turned a tool on quietly is a reopen of the practice, not only of a verb. The deputy is allowed to point at a workflow the owner has grown fond of. Name the person who may switch it off.

The Monday table holds blanks, weak owners, unknown second copies, expected vault silence, and the phrase nothing changed. That is the information. When you automate an extract, write it into the sheet or into a store with the same permission to be empty. A system that opens a ticket for every blank will spend the owner's month on noise, and the recount will slip.

Keep the columns stable. Identity as found. Who. Verb and resource. Objects and chains. The three stories. The fourth statement. State. Evidence. Harm, in sentences, only on the short list, so nobody adds a score column "just in case". Give a script the raw fields. Do not give it a calculated priority. Priority is the hand sort and the single pick.

The script may add a row when a diff sees a new principal. It may not drop a row because the diff stopped seeing one. Disappearance from an export is a claim that the verb died, and claims are what recounts are for. A missing object can mean deleted, or a failed connector, or a query aimed at the wrong scope. One of the public cases lived where a production-scoped export would not have looked. A person checks before the sheet forgets the identifier.

Static administrative passwords in a vault will suggest their own machinery: rotate, record, expire the checkout. None of it changes standing into requested. A workflow that writes "controlled" when rotation succeeds has automated the lie that custody is a change of state. Script the replacement shape only after a person has done it once and the recount held. If the words in the sheet and the script diverge, the words are the claim and the divergence is a reopen.

Do not automate "workload conditional access, so the secret is fine". The workload limit is why a tenant-wide policy is not a covered flag. Where the principal is in class, report-only is still a person reading. Automate the listing of the permission. Covered is a judgment about whether the control binds this object.

A script that strips members from the cloud group and never reads the source will report a clean cloud every morning and lose every afternoon to sync. Automate removal on the winning description, then recount after a cycle. Short-list verbs are still looked at by a person, even when a script performed the removal.

You will be told this does not scale. The extract scales. The judgment, scaled, spreads a mistake. Take the hand method to a second neighbourhood before you widen a rule. A rule that resets the count per business unit gives every unit a fresh green and archives the old reopen. People disagree on an ambiguous verb. The remedy was to tighten the verb, not to hide the disagreement inside a default. If two deputies would not write the same fourth statement, the row is not ready. Produce one row the rule would have marked closed while the morning test still succeeds.

Audit comes next, and it does not change the test. Hand over recount dates, evidence pointers, and the name of the person who looked, and be willing to do it again. A model may draft. A person accepts or rejects the draft on the awkward rows, one line at a time. Using it to leave the answer unattended does not appoint the model as the owner.

The last plea is relief. The owner is tired. The careful response is a smaller neighbourhood, a deputy who can run the recount, and a refusal to open a third cut before the first verb has stayed closed twice. It is not a weekend job that deletes orphans because the month was long.

The Billing-Readers row can sit in an export. The export may show the group and a label that says read. It must not be allowed to write the fourth statement, and it must not be marked closed because a rename landed. A person runs the morning test. If the application role is still assigned, the reset still succeeds.

When the two people leave, the next pair inherits the sheet, the refusals, and the recounts. Inheriting a sentence means being briefed. Inheriting a rule means hoping the author was right forever. The estate will keep minting grants. The practice is how you see the new ones without treating the old close as a law.

Automate the extract. Leave the sentence to a person.