T0-B2 Security Matrix (executable plan)¶
| Item | Value |
|---|---|
| Prepared by | T0-B1 |
| Depends on | Session-scoped active role + GT-T1/GT-T2 fixtures + runtime manifest |
| Status | Executable plan — not executed in T0-B1 |
Do not execute domain workflows outside Core/platform scope in B2.
Actors (from Golden fixtures)¶
| Logical ID | Login | Tenant | Roles |
|---|---|---|---|
GT-AUTH-SCHOOL-ADMIN |
gt.school_admin |
GT-T1 | school_admin |
GT-AUTH-TEACHER-A |
gt.teacher.assigned |
GT-T1 | teacher |
GT-AUTH-HOMEROOM / GT-AUTH-MULTI-NONCONFLICT |
gt.homeroom.7a / gt.multi.teacher_homeroom |
GT-T1 | teacher+homeroom |
GT-AUTH-STUDENT |
gt.student.s1 |
GT-T1 | student |
GT-AUTH-PARENT |
gt.parent.p1 |
GT-T1 | parent |
GT-AUTH-T2-ADMIN |
gt2.school_admin |
GT-T2 | school_admin |
GT-AUTH-T2-TEACHER |
gt2.teacher.assigned |
GT-T2 | teacher |
Secrets via GT_E2E_* only. No superadmin as normal actor.
Matrix¶
| Case ID | Defect / AUTH | Actor(s) | Action | Expected | Evidence artifact |
|---|---|---|---|---|---|
| B2-S007-01 | STAB-007 / AUTH-001 | MULTI | Switch teacher→homeroom | Caps narrow to homeroom only; no union | API permission snapshot + denial of teacher-only route |
| B2-S007-02 | STAB-007 | MULTI ×2 sessions | Independent sessions hold different roles | No cross-session leakage | Dual session cookies |
| B2-S007-03 | STAB-007 | MULTI | Same session two tabs | Shared role after switch | Shared cookie |
| B2-S007-04 | STAB-007 | MULTI | Forged role | Denied | 4xx + audit |
| B2-S007-05 | STAB-007 | MULTI | Revoke assigned role mid-session | Next gate recovers/fails closed | Role removal + probe |
| B2-S007-06 | STAB-007 | any | Stale FE CTA after switch | API uses new authority; refresh reconciles | UI + API pair |
| B2-S008-01 | STAB-008 / AUTH-003 | TEACHER | Fee/LMS specific prefixes | Longest/exact win | Resolver + live call |
| B2-S008-02 | STAB-008 / AUTH-004 | TEACHER | Unregistered protected fixture | Denied | 403 route_unregistered |
| B2-S008-03 | STAB-008 | TEACHER | Method/action confusion GET vs POST create | Method-specific capability | Attachments create |
| B2-S005-01 | STAB-005 | TEACHER | Mail-tracking disallowed model | Denied, no existence leak | Payload + timing |
| B2-S005-02 | STAB-005 | T1 vs T2 | Cross-company mail-tracking / core read | Denied | Dual tenant |
| B2-A004-01 | AUTH-004 | anon/public | login/session/logout | Explicit public policy | Public allowlist |
| B2-A005-01 | AUTH-005 | T1 teacher → T2 object | Guessed ID core read | Denied | Isolation |
| B2-ATT-01 | Core mutation | TEACHER | attachments/create with cap | Allowed for allowlisted model | Positive |
| B2-ATT-02 | Core mutation | TEACHER without cap / wrong model | attachments/create | Denied | Negative |
| B2-DIR-01 | AUTH-012/014 | VIEW-like | Direct API mutation | Denied | Alternate path |
| B2-MAN-01 | AUTH-014 | n/a | Manifest match | FE/BE/DB/fixture checksums match run | Manifest file |
Execution rules¶
- Reset Golden Tenant before matrix run.
- Bind every result to
T0-B1-runtime-manifest.json(updated for the B2 run). - No required skip; missing secret/fixture = FAIL preflight.
- Do not mark STAB-005/007/008 Closed until all acceptance rows for that defect PASS.
Entry gate from T0-B1¶
- [x] Session-scoped role unit + smoke green
- [x] GT-T1/GT-T2 seeded with matching checksum
- [x] Route coverage ambiguous rows = 0
- [x] Protected blockers = 0
- [x] Manifest identifies served build
Execution status (T0-B2)¶
Executed under run ID T0-B2-20260809T015400Z — 39/39 PASS. See T0-B2-result.md and T0-B2-evidence/T0-B2-results.json.
Additional rows exercised: B2-S007-07..10, AUTH-005 read/search/mutation/mail, STAB-005 suite, attachments ±, direct-path, browser smoke.