# Gap Discovery Handoff Laboratory

Status: **Derived From Practitioner Reviewed Method**

Authority: **PRACTITIONER_METHOD / AI_ASSISTED**

> Practice turning one uncomfortable assessment discovery into a bounded, attributable, retestable handoff that a cold reader can reconstruct.

## Authority boundary

This is a fictional teaching record. It does not determine PCI DSS compliance, create a real finding, replace assessor judgment, prescribe remediation, or decide a compliance-accepting entity's response.

## Fictional case

**The seven identities outside the filter**

**Assessment period:** Fictional quarter ending 2026-09-30

**Discovery date:** 2026-09-29

**Assertion:** All 46 privileged identities in the defined production payment environment were reviewed during the quarter and every exception received accountable disposition.

The assessor reconciles the privileged-identity inventory to the quarterly review record. The review ticket contains 39 human administrators. Seven privileged workload identities were excluded by a report filter that returned only user accounts.

## Handoff objects

- **W/! Observed condition** — What exactly was encountered?
- **W/? Claim + subject** — Which assertion, population, environment, and period are affected?
- **W/ Authority basis** — What created the expected state?
- **W/→ Evidence + procedure** — What work produced the observation?
- **W/× Bounded consequence** — What changes now, and what does not?
- **W/↔ Authority + owner** — Who decides, corrects, evaluates, and accepts?
- **W/… Explicit non-claim** — What has not been established?
- **W/✓ Closure + retest** — What proves correction without rewriting history?

## Dated facts

- **GH-01 · 2026-07-01 · Quarterly review criterion** — The approved identity standard requires the quarterly review population to include human and non-human identities with privileged production capability.
- **GH-02 · 2026-09-24 · Completed review ticket** — Ticket IAM-2047 records review decisions for 39 human administrators and states that the complete privileged population was reviewed.
- **GH-03 · 2026-09-29 · Inventory reconciliation** — The assessor joins the identity inventory to the review export and identifies 46 privileged identities: 39 human administrators and seven workload identities.
- **GH-04 · 2026-09-29 · Observed filter condition** — Inspection of the saved report configuration shows accountType=user. The filter excluded all seven privileged workload identities from the quarterly review population.
- **GH-05 · 2026-09-29 · Assessment consequence** — The complete-population assertion is unsupported for the seven omitted identities and for the quarter-wide review claim. The observation does not by itself establish that every access control failed.
- **GH-06 · 2026-09-30 · Accountable decision boundary** — The assessed entity owns correction and its representation. The assessor owns evaluation and retest. The compliance-accepting entity retains program-treatment authority.
- **GH-07 · 2026-09-30 · Explicit non-claims** — No conclusion has been reached about the appropriateness of any omitted permission, other review periods, unrelated identity populations, or the final report response.
- **GH-08 · 2026-10-10 · Correction and retest record** — The owner removes the filter, reviews all 46 identities, dispositions one excessive workload permission, and supplies a new export. The assessor re-runs the population join and inspects the 46 decisions; the historical omission remains preserved.

## Working handoff

| Object | Your bounded record |
| --- | --- |
| Observed condition |  |
| Claim + subject |  |
| Authority basis |  |
| Evidence + procedure |  |
| Bounded consequence |  |
| Authority + owner |  |
| Explicit non-claim |  |
| Closure + retest |  |

## Cold-reader test

- [ ] Can I identify the exact assertion being challenged?
- [ ] Can I identify the affected subject, population, environment, and period?
- [ ] Can I distinguish the observed condition from the criterion and from the claim?
- [ ] Can I reconstruct the evidence sources and procedure that produced the discovery?
- [ ] Can I state the bounded assessment consequence without inventing a broader failure?
- [ ] Can I identify which decision belongs to the entity, assessor, and compliance-accepting authority?
- [ ] Can I see what the record explicitly does not claim?
- [ ] Can I reproduce the closure and retest work without erasing the historical condition?

## Run of show

1. Read only the assertion, period, discovery date, and fictional brief.
2. Classify each dated fact into one handoff object without discussing the model answer.
3. Write one bounded consequence and at least two explicit non-claims.
4. Reveal the model handoff and reconcile disagreements without expanding the fictional facts.
5. Give the completed record to the cold reader and ask all eight reconstruction questions.
6. Record the first failed cold-reader question as the next method or artifact improvement.

---

_The Cluster of Wack is an independent practitioner resource and is not affiliated with or endorsed by PCI SSC._