A fictional vendor says its worker cannot read customer records. Follow the evidence before accepting the answer.
Source assertion
“The worker cannot read customer records.”
Report worker→Service identity→Customer records
A statement is a starting point. Follow the claim to the exact passage and source version.
Evidence inspector
Architecture overview · v3 · §4.2
The report worker runs as svc-report-worker. It reads only from the billing-exports queue and has no access to the customer-records store.
Fictional sample · Exact source context stays attached.
Supporting passage
Keep the passage and its provenance together.
Report worker→Service identity→Customer records
Source: architecture overview v3. Locator: §4.2, page 7. This document supports the statement; it does not verify deployed access.
Evidence inspector
SRC-2 · Architecture overview · 2026-03-02
The report worker runs as svc-report-worker. It reads only from the billing-exports queue and has no access to the customer-records store.
Fictional sample · Exact source context stays attached.
Conflicting evidence
A later policy tells a different story.
Report worker→Service identity→Customer records
The policy grants temporary access. Deployment identity is unresolved, and the final policy revision is missing. Record the conflict; do not declare it resolved.
Evidence inspector
SRC-3 · Access policy revision 17 · 2026-04-15
TemporaryBackfill: Allow store:Read on store/customer-records/* until 2026-06-30.
Fictional sample · Exact source context stays attached.