Evidence Sufficiency Lab | Abdullah Bin Zarshaid

SYNTHETIC EVIDENCE PACKAGE

Offboarding within 24 hours

Claim under review: All in-scope leavers had access removed within 24 hours during the review period.

Select the material you would rely on

Positive numbers represent teaching weight. Unsupported material subtracts confidence. The weight is not a legal or audit standard.

Approved offboarding policySupports intended design, not operation for the population.+5Complete leaver population and defined review periodDefines who and what the claim covers.+25Identity-provider disable events reconciled to the populationDirectly supports when access changed for the scoped identities.+35Offboarding ticket timestamps and exception recordsCorroborates the operational trail and exposes overdue cases.+25A screenshot for one completed userUseful as a sample, but not population-wide proof.+10Unsigned statement that the process “always works”An unbounded assertion adds confidence without inspectable support.-15

SYNTHETIC EVIDENCE PACKAGE

Authorization remediation retest

Claim under review: The reported object-authorization issue is remediated in the tested release and path.

Select the material you would rely on

Positive numbers represent teaching weight. Unsupported material subtracts confidence. The weight is not a legal or audit standard.

Closed remediation ticketShows workflow state, not technical effectiveness.+5Release, endpoint, roles, object and test dateBounds the retest result.+25Before-and-after request/response evidence for denied and permitted casesDirectly supports the tested authorization decision.+40Relevant automated regression checks and resultsAdds repeatable corroboration for the stated path.+20A scoped scanner result with no matching observationCan add context but cannot replace the role/object test.+10Product statement that access is now “fully secure”The statement is broader than the bounded retest evidence.-20

SYNTHETIC EVIDENCE PACKAGE

Detection and escalation readiness

Claim under review: The in-scope detection received the required telemetry, triggered and entered the response workflow.

Select the material you would rely on

Positive numbers represent teaching weight. Unsupported material subtracts confidence. The weight is not a legal or audit standard.

Screenshot of the enabled detection ruleShows configuration at a point in time.+10Source inventory, coverage and ingestion-freshness checkEstablishes whether the expected input was present.+25Controlled test event linked to the resulting alertSupports the rule’s observed behavior in the stated conditions.+35Alert, triage and escalation timestampsSupports entry into the response workflow.+20Current on-call ownership recordCorroborates accountability for the tested workflow.+10A quiet dashboard with no alerts this weekSilence alone does not establish healthy collection or effective detection.-25

A claim is only as useful
as its boundary.

Offboarding within 24 hours

Supported within the boundary

Not established

Still missing or misleading

Authorization remediation retest

Supported within the boundary

Not established

Still missing or misleading

Detection and escalation readiness

Supported within the boundary

Not established

Still missing or misleading

Four different questions.

What are you looking for?

Confirm action

A claim is only as usefulas its boundary.

Supported within the boundary

Not established

Still missing or misleading

Supported within the boundary

Not established

Still missing or misleading

Supported within the boundary

Not established

Still missing or misleading

Four different questions.

A claim is only as useful
as its boundary.