# Access-control incident investigation

## Findings

P0: operator op-7 used valid session sus-7 to export ALL hubs, violating both export-role and hub-scope rules. Requests Q0058–Q0063 succeeded from 09:41 to 09:46 UTC. The gateway recorded 7,200 returned rows and 576,000 bytes across six responses. These are response totals, not unique customers, and do not establish that a file was retained, shared or used by a particular person.

A separate control gap concerns op-2. Session expired-2 logged in at 10:30 and still received a 200 response at 11:15, 45 minutes later. Q0068 and Q0069 establish the timeline beyond the 30-minute TTL. Its 50 rows and 10,000 bytes are separate from op-7's export volume.

## Timeline and counterexamples

- Q0049–Q0054: svc-archive logs in and performs five 10,000-row exports. The service role and approved account satisfy the baseline. High volume alone is not evidence of an incident.
- Q0055–Q0056: supervisor lead-1 exports Harbour within the stated permissions.
- Q0057: op-7 logs in. Q0058–Q0063: the operator role successfully exports all hubs.
- Q0064–Q0067: anonymous requests return 401. These are denied attempts, not confirmed reads.
- Q0068–Q0069: a session remains accepted after 45 minutes.

## Proposed response

P0: the security duty owner preserves gateway, export-audit and identity-login records, including hashes and access controls. An authorized operator temporarily disables operator exports and revokes sus-7. These are recommendations; the exercise does not modify real accounts. The product owner checks other export batches. The compliance owner evaluates any real response obligations after actual file content is established; this log alone is insufficient.

P1: enforce role and hub scope on every API request; enforce session expiry; scope service-account exports by batch and audit them. Alert on successful policy violations rather than frequency alone.

## Validation and fallback

Expect operator /export to return 403, cross-hub operator reads to return 403, authorized supervisor/service access to succeed, and sessions beyond 30 minutes to return 401. Exactly 30 minutes remains valid. Regress legal /orders access. If a control blocks legitimate work, retain the operator export restriction and use an authorized supervisor process instead of removing checks.

Unknowns include the VPN entry path, credential theft, natural-person identity and whether files left a device. Obtain VPN session and endpoint evidence before making those claims.