# Evidence Relationship Cold-Reader Laboratory

Status: **Public Pilot Derived From Reviewed Source**

Authority: **PRACTITIONER_METHOD / AI_ASSISTED**

Reviewed source: **WACK-CONTENT-0168 / sha256:cb6548a8f96948dfbc04c2c3031421b2a814828f7e1e8790621f41eaa29df2f8**

> Test whether a cold reader can traverse one fictional assessment conclusion backward to its authoritative source, then propagate one contradictory fact forward to every affected object and accountable reviewer.

## Authority boundary

This lab exercises relationship quality, change propagation, and accountable review. It does not determine PCI DSS compliance, evidence sufficiency, requirement applicability, an assessment result, or acceptance by a compliance-accepting entity.

## Fictional case

**The filtered support tenant**

**Assessment period:** 2026-07-01 through 2026-09-30

**Starting assertion:** The complete population of identities capable of privileged production administration was reviewed during the fictional Q3 access-review occurrence.

Nimbus Checkout operates a fictional hosted-payment application. Production administration is available through a primary workforce tenant and a separate support tenant used for emergency engineering support. The assessment packet contains an access-review workbook, query notes, approval records, architecture facts, and draft report language. The packet is intentionally mixed. Reconstruct the seven-object chain before looking at the model.

## Relationship objects

- **W/? Conclusion** — What exact report statement is being considered, and where must it stop?
- **W/! Disposition** — Who made the bounded interpretation, under which authority and limitations?
- **W/→ Test** — What procedure was performed, against which population and selection?
- **W/ Evidence** — What object was observed, when, from where, and with which limitations?
- **W/× Population** — What complete candidate set, predicates, exclusions, and variants bounded the test?
- **W/↔ Subject** — Which system, service, identity plane, environment, and boundary does the claim describe?
- **W/∞ Authoritative source** — Which native system or record is authoritative for the represented fact?

## Cold-reader fact packet

- **ER-01 · 2026-09-02 · Draft report sentence** — The draft says all identities capable of privileged production administration were reviewed for Q3.
- **ER-02 · 2026-09-01 · Reviewer sign-off** — The PCI program owner marked the supplied review workbook supported with the limitation that completeness depended on the declared population export.
- **ER-03 · 2026-08-29 · Review procedure** — The reviewer compared each exported identity to current role, manager, business need, privileged group, and recorded action.
- **ER-04 · 2026-08-28 · Access-review workbook** — Twenty-four primary-tenant identities appear with owner, role, decision, reviewer, date, and retained approval reference.
- **ER-05 · 2026-08-27 · Population predicate** — The export used tenant=primary, environment=production, privileged=true, enabled=true, with no recorded variant analysis.
- **ER-06 · 2026-07-14 · Administrative boundary** — The architecture record states that both workforce-primary and support-prod identities can reach the production management plane through different privileged groups.
- **ER-07 · 2026-08-27 · Native identity source** — The workforce-primary directory and support-prod directory are the authoritative sources for enabled identities and privileged-group membership.
- **ER-08 · 2026-09-05 · Two unrepresented accounts** — A joined query across both directories returns two enabled support-prod emergency identities absent from the review workbook.

## Backward trace test

- [ ] Can I quote the exact conclusion without widening its subject, population, or period?
- [ ] Can I identify the accountable disposition and its limitations?
- [ ] Can I reproduce the test procedure and distinguish it from evidence collection?
- [ ] Can I identify the evidence object's provenance, represented period, and non-claims?
- [ ] Can I reconstruct the complete population predicates, exclusions, and variants?
- [ ] Can I identify the stable subject and every relevant administrative path?
- [ ] Can I reach the native authoritative source without relying on the derivative workbook?

## Changed fact

**The support-prod tenant was filtered out** — Two enabled support-prod emergency identities could administer production during the assessment period but were excluded by tenant=primary and do not appear in the review workbook.

**Stop rule:** No automatic PCI DSS conclusion. Preserve the contradiction, reopen the affected records, perform the required work, and route the result to accountable human judgment.

## Observation record

- **First broken join:** __________________________________
- **First overextended claim:** __________________________________
- **Smallest repair:** __________________________________
- **Retest condition:** __________________________________

---

_The Cluster of Wack is an independent practitioner resource and is not affiliated with or endorsed by PCI SSC._