Example · Production deployment
Approval is recorded. Enforcement is unverified.
Evidence reviewed: a fictional workflow diagram and a redacted pipeline excerpt. No live test was performed.
Finding 01 · Alternate execution path
The supplied diagram shows an administrator can start deployment outside the reviewed pipeline. No evidence establishes that this path checks the required approval.
Assessment: unverified exposure. A bypass has not been demonstrated.
Recommended next step: inventory alternate deployment paths and confirm which ones require authorization before execution.
Suggested owner: platform engineering lead. Priority: first, because an uncontrolled alternate path would defeat the reviewed gate.
Finding 02 · Changed work after approval
The excerpt does not show whether approval is bound to the exact artifact. Request configuration evidence; then rehearse a changed-artifact attempt in a simulation.
What the report will distinguish
- Supported findings with evidence references.
- Risks that need testing before they can be asserted.
- Prioritized fixes, suggested owners, and next verification steps.
The audit is an operational control assessment, not a compliance certification, penetration test, or production-enforcement deployment.