A fictional vendor says its background worker cannot read customer records. One document supports that, a configuration excerpt contradicts it, and a later change record says the issue was fixed. See how CliqueMap is designed to show each step.
Illustrative product walkthrough — synthetic example data.Fictional organization, documents, and reviewer. Hand-authored; not generated, not a live system, not a security assessment.
Evidence walkthrough
2 Claims and relationships
Select a labeled connection, or switch to the table. Claims without a single connection (such as reviewed interpretations) appear in the table.
The policy names the same identity, but does not bind it to a deployed worker.
What remains uncertain
The shared name suggests a match, but no deployment binding establishes that the documented worker and policy identity are the same deployed actor. Keep this identity unresolved.
CL-1Source assertion
The report worker reads only from billing-exports and has no access to customer-records.
The report worker runs as svc-report-worker. It reads only from the billing-exports queue and has no access to the customer-records store.
The architecture overview says there is no access to customer-records.
What remains uncertain
The policy shows what was permitted, not whether the permission was used or whether revision 17 was the deployed revision.
CL-3Source assertion
CHG-0142 removed the TemporaryBackfill statement; revision 18 contains only ReadBillingExports.
Stated, not independently observed
Supporting evidence
SRC-4 · Change record CHG-0142 final · dated 2026-07-08 · Summary
Removed the TemporaryBackfill statement from the svc-report-worker policy after the backfill completed. Policy revision 18 contains only ReadBillingExports.
What remains uncertain
Policy revision 18 is not in this corpus, so the removal is reported by the change record but not observed in configuration.
CL-4Reviewed interpretation
The documented restriction plausibly holds from 2026-07-08 onward, but this is unconfirmed: there is no captured revision 18 policy or deployment evidence.
SRC-4 · Change record CHG-0142 final · dated 2026-07-08 · Summary
Removed the TemporaryBackfill statement from the svc-report-worker policy after the backfill completed. Policy revision 18 contains only ReadBillingExports.
The change record says the exception was removed.
What remains uncertain
To close this, request policy revision 18 and evidence of which revision was deployed after 2026-07-08.
4 Sample brief
The brief gathers the question, the current interpretation and its review state, the cited passages, conflicts, and open items into one page.
The report worker runs as svc-report-worker. It reads only from the billing-exports queue and has no access to the customer-records store.
The architecture overview says there is no access to customer-records.
What remains uncertain
The policy shows what was permitted, not whether the permission was used or whether revision 17 was the deployed revision.
CL-3Source assertion
CHG-0142 removed the TemporaryBackfill statement; revision 18 contains only ReadBillingExports.
Stated, not independently observed
Supporting evidence
SRC-4 · Change record CHG-0142 final · dated 2026-07-08 · Summary
Removed the TemporaryBackfill statement from the svc-report-worker policy after the backfill completed. Policy revision 18 contains only ReadBillingExports.
What remains uncertain
Policy revision 18 is not in this corpus, so the removal is reported by the change record but not observed in configuration.
4 Sample brief
The brief gathers the question, the current interpretation and its review state, the cited passages, conflicts, and open items into one page.