# PA-LAB-02 — identity accepted without cancellation authority SYNTHETIC LAB · EXECUTED · Run `cd444897-27a9-4110-8e30-f906254bfc24` Executed: 2026-09-06T04:12:19.428Z to 2026-09-06T04:12:19.494Z. ## Decision brief and scope In a deliberately vulnerable local scheduler, an identified caller without a cancellation grant could change a synthetic appointment. A patient could also substitute an appointment reference belonging to another patient. Both failures were corrected in the second configuration. All six selected cases passed the retest, including two legitimate controls. This is one locally authored Node/SQLite fixture, one cancellation workflow, six deterministic cases per configuration and one trial per case. There is no EHR, deployed service identity, voice/chat model, actual authentication, customer environment or real patient. Notification records are a local outbox, not delivered communications. Source and evidence were produced using coding-assistant tooling. This is not independently validated customer delivery history. ## Agreed fixture rule and prerequisites A confirmed cancellation requires a trusted session for the patient or a currently permitted proxy, with that represented patient bound to the selected appointment at execution. This is the lab's chosen rule, not a universal healthcare policy or legal requirement. Seeded records: two scheduled appointments at version 1, a trusted session for the case's actor, and a cancellation grant for `proxy-1` representing `patient-1`. Sessions and identification are fixtures, so their security is outside the demonstrated scope. Both configurations use the in-process `scheduler-service-lab` label and the same SQL write. ## Finding and reproduction For T01, use the seeded `caller-1` session representing `patient-1`, which has no cancellation grant. Submit operation `cancel`, appointment `appointment-1`, confirmation `true`. Under `vulnerable-v1`, the fixture checks session and confirmation but ignores caller authority. It updates the appointment, commits the transaction and writes one notification to the local outbox. Readback occurs after COMMIT. Request ID: `418120ce-0c19-4347-a361-1cdece458d66`. Session ID: `session-1`. Transaction ID: `6158513f-26f4-4269-bd60-02da5c6e27f2`. Evidence references: E001, E002, E003, E004, E005, E006. Before: `appointment-1`, patient `patient-1`, scheduled, version 1. After: same appointment, cancelled, version 2. One committed transaction and one outbox entry point to the same request and transaction. The authorization event records `authority_satisfied=false` and `permitted=true`. The caller-facing response says cancellation completed, consistent with the synthetic record change. T04 changes the object reference to `appointment-2` while retaining patient-1's session. The vulnerable policy also accepts that write. The fixture's service identity can reach both records; caller-to-record enforcement is missing. ## Demonstrated effect and severity Unauthorized cancellation and a corresponding local outbox record are demonstrated. No clinical consequence or real delivery occurred. A clinical severity, production risk score or CVSS value is not assigned to this isolated teaching fixture. Customer severity would require deployment-specific exploitability, technical effect and owner-supplied operational consequence. No hospital vulnerability prevalence is inferred. ## Correction and owner Fixture implementation owner: Access Red Team lab source, generated through coding-assistant tooling for owner review. Production remediation ownership is outside this lab. `corrected-v2` loads trusted session context and the selected appointment inside the same SQLite transaction, checks their patient binding, and requires the patient themself or a current cancellation grant. It retains the original session and confirmation checks. The write, version increment and outbox insertion share the transaction. This demonstrates the local enforcement change, not a production-ready authentication or integration design. ## Coverage and retest | Case | Expected rule | Vulnerable | Corrected | | --- | --- | --- | --- | | T01 — Identified caller without cancellation authority | deny; no appointment or outbox change | FAIL | PASS | | T02 — Patient cancels own appointment | cancel selected appointment | PASS | PASS | | T03 — Permitted proxy cancels represented patient appointment | cancel selected appointment | PASS | PASS | | T04 — Authorized patient substitutes another patient appointment ID | deny; no appointment or outbox change | FAIL | PASS | | T05 — Patient omits required action confirmation | deny; no appointment or outbox change | PASS | PASS | | T06 — Request uses an unknown session | deny; no appointment or outbox change | PASS | PASS | PASS means the case met the fixture rule. FAIL means it violated that rule. The corrected negative cases leave both appointments, transaction records and outbox unchanged. The legitimate cases cancel only the selected appointment. All six corrected cases passed. Retest disposition: corrected within these configurations and these cases; broader assurance is not established. Deterministic cases are not a reliability or prevalence estimate. ## Artifacts, provenance and integrity - `evidence/receipt.json`: actual times, runtime, source hash, rule, requests, before/after records, case results and evidence references. - `evidence/events.jsonl`: sequenced request, authorization, connector, committed-state, outbox and response observations. - `evidence/scheduler.sqlite`: retained database with synthetic final records, sessions, grants, transactions and outbox entries. - `../lab/assessment.mjs`: exact source for the published run; both configurations and the runner. - `../lab/verify.mjs`: independent artifact checks using hashes and persisted-record correlations. - `../lab/README.md`: commands and limits. Source SHA-256: `055ab3ce88c81c7bc1a997fcac32d277ff5c388b61cd0946730cd7b6a77e0a03`. Events SHA-256: `bd94f4add7a8e81e6574431a6047fde96e449bd6803d44b95d52215376938781`. Database SHA-256: `dee8800aaf0bd45bcaa97238a42756d529480ba0b1b6e9884b3e9b506aaad86a`. Use the verifier to check these exports against the receipt. Hashes detect changed bytes relative to that receipt; they do not independently attest the creator or custody. Host wall-clock timestamps use UTC, with sequence numbers for ordering in this process. No cross-system clock synchronization is asserted. Fresh runs have new IDs and timestamps. ## Unassessed and residual limitations Real authentication, independent service/OAuth authorization, vendor/EHR behavior, telephony, language models, prompt injection, timeouts, retries, concurrent access, revocation races, callback routing, external delivery, capacity and recovery in production were not assessed. A separate unit control checks a grant removed before a request; it does not execute PA-01's active-session timing specification, which remains NOT RUN. Further customer work must begin with approved scope, the customer's rules, operational owners, target/vendor authorization and verified evidence-handling arrangements. This lab is reproducible evidence of these local mechanics only.