Quarterly review criterion
The approved identity standard requires the quarterly review population to include human and non-human identities with privileged production capability.
OBSERVE → BOUND → TRACE → HANDOFF → RETEST
Finding the gap starts the work.
This is a fictional teaching record. It does not determine PCI DSS compliance, create a real finding, replace assessor judgment, prescribe remediation, or decide a compliance-accepting entity's response.
W/ OPERATIONS DESK / COLD-READER TABLETOP
Make the gap exact enough to hand off.
Practice turning one uncomfortable assessment discovery into a bounded, attributable, retestable handoff that a cold reader can reconstruct.
FICTIONAL CASEThe seven identities outside the filter
The assessor reconciles the privileged-identity inventory to the quarterly review record. The review ticket contains 39 human administrators. Seven privileged workload identities were excluded by a report filter that returned only user accounts.
- Assessment period
- Fictional quarter ending 2026-09-30
- Discovery date
- 2026-09-29
- Assertion
- All 46 privileged identities in the defined production payment environment were reviewed during the quarter and every exception received accountable disposition.
- W/!Observed condition
What exactly was encountered?
- W/?Claim + subject
Which assertion, population, environment, and period are affected?
- W/Authority basis
What created the expected state?
- W/→Evidence + procedure
What work produced the observation?
- W/×Bounded consequence
What changes now, and what does not?
- W/↔Authority + owner
Who decides, corrects, evaluates, and accepts?
- W/…Explicit non-claim
What has not been established?
- W/✓Closure + retest
What proves correction without rewriting history?
01 / CLASSIFY THE RECORD
Eight facts. Eight different jobs.
Assign each fact to the handoff object it can support. Do not decide the final assessment result.
Completed review ticket
Ticket IAM-2047 records review decisions for 39 human administrators and states that the complete privileged population was reviewed.
Inventory reconciliation
The assessor joins the identity inventory to the review export and identifies 46 privileged identities: 39 human administrators and seven workload identities.
Observed filter condition
Inspection of the saved report configuration shows accountType=user. The filter excluded all seven privileged workload identities from the quarterly review population.
Assessment consequence
The complete-population assertion is unsupported for the seven omitted identities and for the quarter-wide review claim. The observation does not by itself establish that every access control failed.
Accountable decision boundary
The assessed entity owns correction and its representation. The assessor owns evaluation and retest. The compliance-accepting entity retains program-treatment authority.
Explicit non-claims
No conclusion has been reached about the appropriateness of any omitted permission, other review periods, unrelated identity populations, or the final report response.
Correction and retest record
The owner removes the filter, reviews all 46 identities, dispositions one excessive workload permission, and supplies a new export. The assessor re-runs the population join and inspects the 46 decisions; the historical omission remains preserved.
Write what changes—and what does not.
0 of 8 facts classified.
03 / REMOVE THE AUTHOR
0 / 8 answerableCan a cold reader reconstruct the decision?
The first unanswered question is the next improvement—not an invitation to widen the conclusion.
Reopen the handoff when the proposition changes.
- A new privileged identity type or source becomes part of the defined environment.
- The report filter, inventory join, review procedure, population owner, or period changes.
- A later occurrence omits an identity, lacks a disposition, or contradicts the recorded population.
- The assessed entity changes its assertion or the compliance-accepting entity supplies new direction.
Run the tabletop with five roles.
Handoff builder · Assessed-entity owner · Assessor · Cold reader · Decision recorder
- Read only the assertion, period, discovery date, and fictional brief.
- Classify each dated fact into one handoff object without discussing the model answer.
- Write one bounded consequence and at least two explicit non-claims.
- Reveal the model handoff and reconcile disagreements without expanding the fictional facts.
- Give the completed record to the cold reader and ask all eight reconstruction questions.
- Record the first failed cold-reader question as the next method or artifact improvement.