{
  "evidenceId": "E12",
  "title": "IAM historical migration exceptions",
  "originalRelativePath": "MR33_MIGRATION_WORK/mediflex/iam-completion/DELIVERY_STATUS.json",
  "originalSha256": "cf79ee17deb8ce5c069df8f91fbcd54c3730e310a426413f1dd5e5d3694e1541",
  "boundary": "Historical legacy classifications/audit data and specialist-permission exceptions; recheck before treating counts as current.",
  "capturedForHandover": "2026-10-20",
  "record": {
    "status": "DEPLOYED_VERIFIED_WITH_SOURCE_EXCEPTIONS",
    "change": "IAM required data, governed exports and reviewed TimeVault role versions",
    "safeLegacyMapping": "Source workbook evidence, typed provider links, consistent active party links and existing role/profile definitions only.",
    "demoSteps": [
      "Open RBAC Administration > Roles, choose a role and expand Purpose, Export and TimeVault within its details card.",
      "Create an access purpose if needed, then configure the directory, purpose, export permission, maximum rows, masking and validity period. Submit with a business reason.",
      "An independent eligible reviewer uses Access Governance > Approval Queue. Requesters and affected beneficiaries cannot approve their own changes.",
      "A user with the approved role can export its configured IAM directory page using the approved purpose and a recorded business reason.",
      "When TimeVault is required, only the exact independently reviewed and preserved role definition is effective. Later definition changes require another preserved approval."
    ],
    "purposeExportScope": [
      "IAM Users",
      "IAM Roles",
      "IAM Profiles",
      "IAM Domains"
    ],
    "sourceExceptions": [
      "98 legacy users have no recoverable User Category; 18 domains have no recoverable Domain Type. They remain flagged for authoritative review.",
      "Unavailable historical creation actors/times and seven effective-start values are not fabricated; open-ended end dates remain valid.",
      "Six imported specialist permission fixtures have no matching owner operation provider. Their existing scoped/purpose/export/masking restrictions continue to deny access; they are not mapped to unrelated IAM directory reads.",
      "Validation uses the captured 209-field, 14-table workbook mapping and current runtime field lengths. The original workbook was not available for independent length certification."
    ],
    "evidence": [
      "NATIVE_PROOF.json",
      "PERMISSION_SCENARIO_PROOF.json",
      "GOVERNANCE_BROWSER_PROOF.json",
      "BROWSER_PROOF.json",
      "NATIVE_NAVIGATION_PROOF.json",
      "iam-completion-live-native.log",
      "iam-completion-live-permissions.log",
      "iam-completion-audit-mediflex_db.json",
      "iam-completion-live-deployment.json"
    ],
    "realUserPasswordLoginTested": false,
    "deployment": {
      "status": "DEPLOYED_VERIFIED",
      "updatedAtUtc": "2026-10-07T02:19:25.443816+00:00",
      "root": "OPS-REF-8dd1afb6aedc (resolve in operator source baseline)",
      "releaseSha256": "c65fb33aa41087a0e21647f6fe2b99cff16d7af6ca197985ccb173a3919120ca",
      "filesVerified": 11307,
      "backup": "/opt/kernel/backups/iam-completion-20261007T021809Z",
      "databaseChanged": true,
      "nativeAcceptancePassed": true,
      "businessApprovalsCreated": false,
      "generatedEntryVerified": true,
      "publicAccountClientVerified": true,
      "applicationAuthenticationPreserved": true
    },
    "auditedCorrections": 516,
    "runtimeBindingProblems": [],
    "lengthViolations": [],
    "runtimeTests": [
      {
        "rolledBack": true,
        "crossTenantDenied": true,
        "selfApprovalDenied": true,
        "expiredVersionDenied": true,
        "withdrawnApprovalDenied": true,
        "tamperedDefinitionDenied": true,
        "timevaultIndependentApproval": true
      },
      {
        "requiredUserCategoryEnforced": true,
        "requiredCreateEnvelopeEnforced": true,
        "requiredMetadataFieldsEnforced": true,
        "acceptedLengthBoundariesAndRejectedOverflow": 11
      },
      {
        "boundedRows": true,
        "receiptRecorded": true,
        "stalePolicyDenied": true,
        "serverExportMasked": true,
        "contextForgeryDenied": true,
        "expiredPurposeDenied": true,
        "unknownPurposeDenied": true,
        "clientAuthorityDenied": true,
        "userExportMaskEnforced": true,
        "selectedProfileIsolation": true,
        "unconfiguredSourceDenied": true,
        "independentExportApproval": true,
        "independentPurposeApproval": true,
        "userExportNoAccessEnforced": true,
        "purposeFlagProviderEnforced": true,
        "userDirectoryAliasProtected": true,
        "directObligationBypassDenied": true,
        "userExportMatchesOwnerPaging": true,
        "exportObligationNotSatisfiedByView": true
      }
    ],
    "permissionScenarios": 20,
    "uiTests": 13,
    "typecheck": "PASS",
    "browserChecks": "PASS",
    "directoryRequest50UsersMilliseconds": 646.829,
    "workbookMapping": {
      "fields": 209,
      "tables": 14,
      "runtimeFieldBindings": 156,
      "originalWorkbookLengthCertification": false
    },
    "remainingRequiredValues": [
      {
        "owner": "kh_iam.resp_scope",
        "field": "division_type_code",
        "count": 18,
        "disposition": "Authoritative classification or owner metadata required"
      },
      {
        "owner": "kh_iam.resp_scope",
        "field": "created_by_subject_id",
        "count": 6,
        "disposition": "Historical audit value unavailable; preserved as recorded"
      },
      {
        "owner": "kh_iam.user_account",
        "field": "user_category_code",
        "count": 98,
        "disposition": "Authoritative classification or owner metadata required"
      },
      {
        "owner": "kh_iam.user_account",
        "field": "eff_from",
        "count": 5,
        "disposition": "Authoritative classification or owner metadata required"
      },
      {
        "owner": "kh_iam.user_account",
        "field": "eff_to",
        "count": 88,
        "disposition": "Valid open-ended period"
      },
      {
        "owner": "kh_iam.user_account",
        "field": "created_by_subject_id",
        "count": 51,
        "disposition": "Historical audit value unavailable; preserved as recorded"
      },
      {
        "owner": "kh_iam.user_account",
        "field": "created_at",
        "count": 36,
        "disposition": "Historical audit value unavailable; preserved as recorded"
      },
      {
        "owner": "kh_iam.membership_scope_binding",
        "field": "created_by_subject_id",
        "count": 50,
        "disposition": "Historical audit value unavailable; preserved as recorded"
      },
      {
        "owner": "kh_axis.crud_screen_def",
        "field": "effective_to",
        "count": 5,
        "disposition": "Valid open-ended period"
      },
      {
        "owner": "kh_axis.journey_navigation_rule",
        "field": "effective_to",
        "count": 5,
        "disposition": "Valid open-ended period"
      },
      {
        "owner": "kh_axis.form_field_def",
        "field": "effective_to",
        "count": 5,
        "disposition": "Valid open-ended period"
      },
      {
        "owner": "kh_iam.role",
        "field": "eff_from",
        "count": 1,
        "disposition": "Authoritative classification or owner metadata required"
      },
      {
        "owner": "kh_iam.role",
        "field": "eff_to",
        "count": 45,
        "disposition": "Valid open-ended period"
      },
      {
        "owner": "kh_iam.role",
        "field": "created_by_subject_id",
        "count": 79,
        "disposition": "Historical audit value unavailable; preserved as recorded"
      },
      {
        "owner": "kh_iam.role_permission_grant",
        "field": "created_by_subject_id",
        "count": 15522,
        "disposition": "Historical audit value unavailable; preserved as recorded"
      },
      {
        "owner": "kh_iam.access_profile",
        "field": "eff_from",
        "count": 1,
        "disposition": "Authoritative classification or owner metadata required"
      },
      {
        "owner": "kh_iam.access_profile",
        "field": "eff_to",
        "count": 43,
        "disposition": "Valid open-ended period"
      },
      {
        "owner": "kh_iam.access_profile",
        "field": "created_by_subject_id",
        "count": 87,
        "disposition": "Historical audit value unavailable; preserved as recorded"
      },
      {
        "owner": "kh_iam.access_profile_role",
        "field": "created_by_subject_id",
        "count": 93,
        "disposition": "Historical audit value unavailable; preserved as recorded"
      },
      {
        "owner": "kh_iam.access_profile_asgn",
        "field": "created_by_subject_id",
        "count": 112,
        "disposition": "Historical audit value unavailable; preserved as recorded"
      }
    ]
  },
  "readerProjection": "Kernel-scoped projection. Legacy infrastructure identifiers are opaque operator references; original source SHA256 is retained. No runtime identifier was renamed."
}