{
  "schemaVersion": "flare-public-evaluation-case/v1",
  "publishedAt": "2026-10-28",
  "caseId": "aws-role-tag-with-abac-policy",
  "dataClassification": "Synthetic test fixture; no customer incident data",
  "input": {
    "source": "aws",
    "baselineContext": "Confirmed policy for build-role allows secretsmanager:GetSecretValue on resources whose project tag equals aws:PrincipalTag/project. Its previous project tag was development; finance-prod resources contain production finance secrets. Approval for this change is unknown.",
    "evidence": [
      {
        "timestamp": "2026-09-10T10:00:00Z",
        "source": "aws",
        "rawFields": {
          "eventId": "fresh-aws-TagRole",
          "eventTime": "2026-09-10T10:00:00Z",
          "eventName": "TagRole",
          "eventSource": "iam.amazonaws.com",
          "userIdentityArn": "arn:aws:iam::111122223333:role/new-operator",
          "requestParameters": {
            "roleName": "build-role",
            "tags": [
              {
                "key": "project",
                "value": "finance-prod"
              }
            ]
          }
        }
      }
    ]
  },
  "capturedBefore": {
    "summary": "No reviewable security findings in 1 analyzed record under the configured policy. Assessed actions: TagRole. This result applies only to the analyzed window.",
    "findings": []
  },
  "capturedAfter": {
    "explanation": "1 cited audit record: \"TagRole\" (no error recorded; outcome details may be incomplete) by \"arn:aws:iam::111122223333:role/new-operator\" targeting \"build-role\" at \"2026-09-10T10:00:00Z\"; Recorded tags: [{\"key\":\"project\",\"value\":\"finance-prod\"}]. The supplied policy links principal tag \"project\" on role \"build-role\" to authorization. Review the requested tag change against that policy and approved attributes; the request alone does not establish effective permissions, successful data access or compromise.",
    "findingType": "iam_policy_change",
    "evidenceEventIds": [
      "fresh-aws-TagRole"
    ],
    "totalLogsAnalyzed": 1
  },
  "annotation": {
    "status": "Publication annotation, not the original scoring rubric",
    "expectedBehavior": "Surface the policy-relevant requested tag change, cite the event, and distinguish the request from effective permissions, successful data access or compromise.",
    "policyContextSource": "Explicitly supplied in the test input; not inferred from the audit record.",
    "nextStep": "Review effective policy, resulting tags, approval and subsequent access evidence if available."
  },
  "targetedGrades": {
    "detection": {
      "before": 1,
      "after": 5
    },
    "explanation": {
      "before": 1,
      "after": 5
    }
  },
  "limitations": [
    "A selected repair case is not a representative accuracy estimate.",
    "Captured fields are an excerpt, not the entire model transcript.",
    "The scorecard documents incomplete judge qualification and a failed exact severity-calibration control."
  ],
  "provenance": {
    "fixtureSha256": "6878046cc9e315124e435f920917d420809116048f1910475c80a681ebc72ad7",
    "captureSha256": "3ba5a9d8318dfa2a8b136b4735f1aff76cac7d8f6944a0f83d47cbabcce75dc8",
    "repairCommit": "2099e4a9f7a01f2cb413700544f10b044f2fcf35",
    "policyVersion": "flare-review-policy/v4"
  }
}