# The webhook that moved only one document

**Runtime:** 45 minutes

## Scenario

Northwind Market adds an Internet-facing payment-status webhook behind a cloud edge service. The application inventory adds the endpoint and the architecture diagram shows the connection. The ASV and external vulnerability scan populations still contain the prior public addresses. The penetration-testing methodology does not name webhook behavior. The TPSP responsibility record describes payment processing but not callback delivery. A screenshot from staging is attached to the production control claim.

## Change inject

Ten minutes into the exercise, reveal that the webhook now invokes a serverless function through a workload identity and writes transaction references to a managed queue used by customer support.

## Required outputs

- Changed fact record
- Four position claims
- Downstream consumer list
- Contradiction register
- Bounded disposition with owners and reopening triggers

## Debrief questions

1. Which fact changed first?
2. Which position appeared current while another remained stale?
3. Which provider and customer verbs required separation?
4. Which testing populations or propositions needed reconsideration?
5. What could the evidence support, and where did support stop?
6. What would the assessor validate without becoming the owner of the repair?

## Boundary

Use fictional or sanitized information only. The exercise exposes relationships and unsupported claims; it does not decide scope, compliance, validation eligibility, or acceptance.

The Diamond Fulcrum is Scott Norton's independent practitioner model. It is not PCI SSC terminology or U.S. Navy doctrine and does not imply affiliation with or endorsement by PCI SSC, the U.S. Navy, or the Blue Angels.