Here is Leela’s reading of the project.
The phrases that matter, and the rule each one touches.
The project
Orchard Cloud, a fictional U.S. software and services company, wants a support vendor to inspect customer tickets and application logs. The proposed role is read-only and scoped to assigned tickets and relevant logs. Access duration, named users and removal ownership still need confirmation. No customer tickets are supplied.
Underlined phrases are the ones Leela connected to a rule. Pick one to see its connection.
How Leela connects it
A vendor sees only what the support work needs, for as long as it needs it.
Leela’s initial reading
Leela prepares two of three steps.
- Leela: Prepare an access review checklist
- Leela: Prepare a vendor review package
- Your team: Approve and grant the actual access
If the vendor asks for administrator access instead: T2 applies. It needs a separate security-owner decision, justification, time limit and monitoring plan, and Leela prepares an elevated-access risk memo. See this version →
Orchard Cloud and its rules are fictional. Leela’s reading is a first pass; a qualified person reviews it before anyone acts on it.
Before any draft is used: Confirm the actual facts and source material. Your team reviews and approves the draft before use.
Document the support access boundary
Potentially applicable- Leela prepares
- Prepare an access review checklist
A draft review of permitted tickets, logs, named users, duration, audit logging and removal responsibility.
Why this matters & sources · Open questions
Customer tickets and logs may contain data beyond the support task.
Uncertainty: Prepared from fictional inputs. Applicability to an actual company requires review.
The fictional rule below is the basis for this example finding. Customer tickets and logs may contain data beyond the support task.
Approve and grant the actual access: Your security owner reviews the scope; your team provisions and later removes access. A responsible person makes and records this decision.
Related policy examples: Complete tier-appropriate due diligence before engaging
Confirm vendor data-handling controls
Needs expert review- Leela prepares
- Prepare a vendor review package
A draft diligence request covering data handling, subprocessors and deletion.
Why this matters & sources · Information missing
T1 requires documented data handling and access responsibility.
Uncertainty: Prepared from fictional inputs. Applicability to an actual company requires review.
Missing information: Actual customer contracts, security obligations and sensitive-data restrictions must be confirmed.
The fictional rule below is the basis for this example finding. T1 requires documented data handling and access responsibility.
Related policy examples: Complete tier-appropriate due diligence before engaging