Archive catalogue: the all-powerful service token

The Tawi Archive catalogue only lists and shows public records, yet the records store's audit trail shows it calling with the admin token issued to the nightly export job, which can also export every private field. Inspect the running service from the terminal, give it the least privilege it needs without breaking the catalogue, prove the repair, and write a rule over the audit log that would have caught it.

The machine has three containers: the service you repair (your terminal opens there), an internal records store, and the platform's assurance agent. Two flags: the repair flag, which attest hands over once every check passes, and the detection flag, which detect hands over when your rule catches every misuse line in the incident log and its holdout and nothing else. Every name, organisation and address in the machine is fictional and generated for you.

Your terminal opens in the service container as ops. Edit the running copy of the service in /gen/app (start with /gen/app/store.ini and /gen/data/tokens/README.txt); your generated data, including the incident log incident.jsonl, is in /gen/data. Run restart after an edit, check to see the table the platform grades, attest for the repair flag and reset to start again. A detection rule is JSON, {"match": "all", "conditions": [{"field": ..., "op": ..., "value": ...}]}, where op is equals, contains, in_set or count_over, match may also be any or {"n": 2}, and the fields are the keys of each log line except id; grade it with detect rule.json. attest and detect accept 20 attempts in five minutes.