Define risk
Document imagined failure paths, assets, assumptions and qualitative severity. Ordinal 1–5 scores are an illustration, not measured probabilities.
Cybersecurity GRC · IAM
A valid login is not a trust decision
A supplier may have valid credentials without being entitled to a particular customer’s documents. In a fictional SaaS scenario, I examined which evidence would justify access — and when the right decision is to withhold approval.
The business decision
Should a document-processing vendor receive access to selected customer files? The exercise maps 12 synthetic assets and 12 hypothetical risks, then drafts a 12-question supplier due-diligence checklist. Without independently checked safeguards, the simulated decision remains HOLD.
How the assessment was structured
Constrain access
Reason about identities, roles, individual tenant documents, authorized purpose, expiry and the provenance of external data.
Ask for evidence
Require scoped approvals, offboarding, auditability, subcontractor transparency and recovery evidence before treating a control as effective.
What I checked
The completed educational case study uses 20 synthetic identities across five roles and 24 illustrative IAM access scenarios. On 3 November 2026, a GitHub Actions regression run passed all 58 Python unittest methods: 11 risk/vendor-fixture checks, 16 IAM tests and 31 tenant/document-scoping tests. A separate step also checked all 24 simulated IAM decisions. These checks validate a fictional decision model, not deployed IAM controls or an actual supplier.
A critical review exposed a flaw: initially, any nonempty approval ID could satisfy the toy check. I revised it to bind mock approvals to a subject, tenant, specific document, action and expiry, then added negative tests. The registry is simulated, not an authoritative approval system.
The v1.0 portfolio study is complete within its synthetic, educational scope. The closure review records its acceptance criteria and limitations. The fictional vendor decision remains HOLD, and residual risk remains NOT ASSESSED.
What the results do not establish
This is independent educational work, not an external audit, customer engagement, ISO/NIST certification or demonstrated production protection. No real credentials, suppliers, customer records, identity providers or live systems were tested. Hypothetical inputs about authentication, contracts and source integrity are not independent security evidence.
Passing a synthetic test is useful when it confirms the logic matches its documented rules. It does not prove those rules are complete, that the inputs are trustworthy, or that the design would resist a real attacker.
The lesson
The distinction worth preserving is between a technically possible action and one justified by current, verifiable evidence. A legitimate login is one input to an authorization decision, not a substitute for that decision.