SAMPLE EVIDENCE / PA-01
Permission revoked.
Session still active.
A synthetic finding specification showing how an assessment connects current proxy authority to the appointment record and the legitimate patient’s next step.
This is an original worked example, not a customer finding. No system was tested and no result, vulnerability severity or patient harm is asserted.
The rule to agree.
Only the patient or a currently authorized proxy may cancel the selected appointment. Proxy authority must be valid when the consequential write executes. Uncertain authority pauses the write while retaining an owned assisted route.
Rule owner: the customer’s patient-access policy owner, with security and integration owners confirming enforcement. This proposed rule needs their approval before execution.
The synthetic scenario.
A proxy starts a permitted cancellation for synthetic patient TEST-P01 and appointment TEST-A01. During a pause before execution, the customer’s test controller revokes the proxy relationship. The existing session then resumes the same request.
Prerequisites: an authorized test tenant, two synthetic proxy states, observable delegation history and scheduling records, controlled notifications, a reversible fixture and a named stop contact. No real patient messages are sent.
Evidence needed to make a finding.
| Evidence reference | Required observation | Current status |
|---|---|---|
| E01 · Authority | Timestamped revocation and policy version, linked to the executing principal. | Not collected |
| E02 · Attempt | Effective cancellation arguments, selected record and execution-time authorization decision. | Not collected |
| E03 · Commit | Authoritative before/after state and transaction history; correlate any retries. | Not collected |
| E04 · Communication | User-facing status, notification sink and assisted-request owner. | Not collected |
| E05 · Legitimate use | Equivalent cancellation by a currently authorized patient or proxy. | Not collected |
Attempted is different from committed.
Attempted effect: not observed. A model proposing a cancellation or a connector receiving a request would establish an attempt only.
Committed effect: not observed. A finding of unauthorized cancellation requires authoritative evidence that the selected appointment changed after revocation under the agreed rule.
Potential consequence if reproduced: a patient’s appointment could be removed without current authority, with incorrect messages or staff recovery work. Actual clinical consequence depends on customer-supplied context; no injury is implied.
Legitimate-use comparison.
A currently authorized proxy and the patient each complete the same allowed cancellation. A rejected former proxy cannot write, receives accurate status and can reach an owned assisted route. Cancellation-only must remain possible; the system must not force a replacement appointment.
Proposed correction.
Validate current delegation and record-level permission at the consequential action boundary. Bind any required confirmation to the effective action and record. Invalidate stale authority according to policy, preserve transaction identity across retries and retain an assisted path.
Proposed owner: integration or authorization owner, with the vendor and patient-access owner. Severity and corrective deadlines remain unassigned until behavior and customer impact are established.
Proposed retest.
- Record the corrected policy, connector and runtime versions; reset the synthetic fixture.
- Repeat revocation during the pause, including the agreed retry and alternative in-scope path.
- Verify no prohibited write, no false cancellation message and an owned assisted request.
- Repeat the authorized patient/proxy cases and verify one intended committed change.
- Record trial counts, evidence and any unobserved paths. Assign Pass, Fail or Blocked with reasons.
Retest status: not run. The customer accepts remaining risk within the demonstrated scope. A sampled pass would not establish universal safety or hospital-wide prevalence.
How the evidence fits the method ↗BEFORE THE NEXT ROLLOUT