Challenge the System#

Week 7 · MASTERMIND

A recognised identity is not a permission.

The unexpected results#

A maintainer can read embargoed research.

A reader cannot read it.

Both results contradict this charter.

State this charter first#

Readers may read research.

Maintainers may service equipment.

Custodians may read and approve release.

Three parts of a request#

Subject: maintainer

Action: read

Object: embargoed research

Identity and authority#

Identity answers who.

Permission answers may they do this.

A job title does not grant every right.

Predict this matrix#

Preserve both failures#

Maintainer → read: deny expected, allow observed.

Reader → read: allow expected, deny observed.

Make the two repairs#

Deny maintainer research reading.

Restore reader research reading.

Preserve the seven valid decisions.

Denying everything fails too#

No unauthorised operation succeeds.

But the reader cannot do required work.

Useful access is part of the contract.

Recheck all nine cases#

Reader reading succeeds.

Maintainer reading fails; service succeeds.

Custodian reading and approval succeed.

A release hold arrives#

Custodian approval is suspended.

Research reading is unchanged.

Maintainer service is unchanged.

Your decision exercise#

Which cell changes under the release hold?

Which permissions should remain?

What would a global denial break?

A2: keep a traceable record#

Preserve the diagnosis and source comparison.

Keep both justified policy versions.

Label each person’s contribution.

Derive your own lab policy#

Read the recovery mandate.

Predict → test → repair → recheck.

Then apply its maintenance hold.

Open the Week 7 lab