{
  "engine": "ori.engine.cjs",
  "reportVersion": "synthetic-reproducible-1",
  "generatedAt": "2026-10-18T21:48:53.944Z",
  "input": {
    "organization": {
      "name": "SYNTHETIC — Cedarworks Ltd.",
      "industry": "other",
      "industry_key": "other",
      "companySize": "small_50_250",
      "infraClass": "hybrid"
    },
    "questionCount": 30,
    "case": "Fictional identity controls; scenario declarations vary while all unrelated controls remain unknown."
  },
  "scenarios": {
    "declared": {
      "scores": {
        "observedMaturity": 29.8,
        "operationalConfidence": 0.5,
        "hiddenExposureResidual": "Critical",
        "globalResponseConcentration": 100,
        "globalStateDistinguishability": 16.2,
        "globalEntropy": 0,
        "globalBoundaryActivation": 27,
        "globalStabilityRadius": 83.8,
        "crossDomainCoherence": 99.4,
        "rawResidualFraction": 0.995
      },
      "topFindings": [
        {
          "title": "Cross-account trust relationships — control state is unproven",
          "severity": "Critical"
        },
        {
          "title": "OAuth applications — control state is unproven",
          "severity": "Critical"
        },
        {
          "title": "Prove log coverage across identity — control state is unproven",
          "severity": "Critical"
        },
        {
          "title": "AI-assisted remediation or automation actions constrained by human approval gates — control state is unproven",
          "severity": "Critical"
        }
      ],
      "prioritizedEvidence": [
        {
          "evidence": "Restore test evidence from last 90 days",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "Backup access control review",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "Recovery account inventory with MFA enrollment status",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "Immutable backup storage configuration evidence",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "CI/CD identity inventory and privilege review",
          "domain": "Third-Party & Supply Chain",
          "expectedGain": 34.919
        }
      ],
      "coherenceFindings": []
    },
    "evidencePending": {
      "scores": {
        "observedMaturity": 29,
        "operationalConfidence": 0.5,
        "hiddenExposureResidual": "Critical",
        "globalResponseConcentration": 96.2,
        "globalStateDistinguishability": 15,
        "globalEntropy": 0.1,
        "globalBoundaryActivation": 27.1,
        "globalStabilityRadius": 84.3,
        "crossDomainCoherence": 99.4,
        "rawResidualFraction": 0.995
      },
      "topFindings": [
        {
          "title": "Cross-account trust relationships — control state is unproven",
          "severity": "Critical"
        },
        {
          "title": "OAuth applications — control state is unproven",
          "severity": "Critical"
        },
        {
          "title": "Prove log coverage across identity — control state is unproven",
          "severity": "Critical"
        },
        {
          "title": "AI-assisted remediation or automation actions constrained by human approval gates — control state is unproven",
          "severity": "Critical"
        }
      ],
      "prioritizedEvidence": [
        {
          "evidence": "Restore test evidence from last 90 days",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "Backup access control review",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "Recovery account inventory with MFA enrollment status",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "Immutable backup storage configuration evidence",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "CI/CD identity inventory and privilege review",
          "domain": "Third-Party & Supply Chain",
          "expectedGain": 34.919
        }
      ],
      "coherenceFindings": []
    },
    "dependenciesUnknown": {
      "scores": {
        "observedMaturity": 23.8,
        "operationalConfidence": 0.5,
        "hiddenExposureResidual": "Critical",
        "globalResponseConcentration": 94.9,
        "globalStateDistinguishability": 13.2,
        "globalEntropy": 0.1,
        "globalBoundaryActivation": 31.2,
        "globalStabilityRadius": 87.3,
        "crossDomainCoherence": 99.4,
        "rawResidualFraction": 0.995
      },
      "topFindings": [
        {
          "title": "Privileged roles reviewed against actual business need and last-used activity — control state is unproven",
          "severity": "Critical"
        },
        {
          "title": "Cross-account trust relationships — control state is unproven",
          "severity": "Critical"
        },
        {
          "title": "OAuth applications — control state is unproven",
          "severity": "Critical"
        },
        {
          "title": "Prove log coverage across identity — control state is unproven",
          "severity": "Critical"
        }
      ],
      "prioritizedEvidence": [
        {
          "evidence": "Restore test evidence from last 90 days",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "Backup access control review",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "Recovery account inventory with MFA enrollment status",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "Immutable backup storage configuration evidence",
          "domain": "Resilience & Recovery",
          "expectedGain": 35.03
        },
        {
          "evidence": "CI/CD identity inventory and privilege review",
          "domain": "Third-Party & Supply Chain",
          "expectedGain": 34.919
        }
      ],
      "coherenceFindings": [
        {
          "controlId": "mfa_privileged",
          "controlLabel": "Is MFA enforced for all privileged identities, including break-glass accounts, contractors, and service accounts where applicable?",
          "domain": "identity",
          "coherence": 15,
          "missingDeps": [
            {
              "id": "privilege_review",
              "label": "Are privileged roles reviewed against actual business need and last-used activity?",
              "hiddenStructures": [
                "overprivileged users whose role has changed",
                "inherited admin roles from historical group membership",
                "unused privileged groups with no active members",
                "privilege accumulation through job changes without revocation"
              ],
              "riskWeight": 0.95
            },
            {
              "id": "identity_federation_map",
              "label": "Do you maintain a map of federation paths between IdP, cloud IAM, SaaS apps, and CI/CD systems?",
              "hiddenStructures": [
                "unmapped federation paths granting implicit privilege",
                "privilege inheritance chains across identity providers",
                "external IdP trust chains not reflected in access reviews",
                "CI/CD identities bypassing workforce identity controls"
              ],
              "riskWeight": 0.95
            },
            {
              "id": "stale_identities",
              "label": "Do you review stale, dormant, orphaned, or unowned identities at least monthly?",
              "hiddenStructures": [
                "dormant privileged users retained after role change",
                "orphaned contractor accounts not deprovisioned",
                "unused service principals with inherited access",
                "unowned accounts retaining group-based privilege"
              ],
              "riskWeight": 0.9
            }
          ],
          "consequence": "Without evidencing these 3 supporting controls, ORI cannot constrain the hidden operational state behind this claim.",
          "whatToDo": "Evidence privileged roles reviewed against actual business need and last-used activity first — this is the highest-risk missing dependency and closes the largest share of hidden state ambiguity for this control."
        }
      ]
    }
  },
  "syntheticTelemetry": {
    "inputCounts": {
      "privileged": 12,
      "mfaEnrolled": 10,
      "mfaMissing": 2
    },
    "observations": [
      {
        "type": "privileged_identity_without_mfa",
        "count": 2,
        "severity": "high",
        "description": "Privileged identities without MFA-equivalent controls"
      }
    ],
    "statusChanges": [],
    "contradictions": [],
    "validationCoverage": 0,
    "description": "Synthetic identities normalized and evaluated with ORI observation functions; population coverage is unverified."
  },
  "tests": {
    "determinism": "PASS",
    "syntheticMfaGap": "PASS",
    "coverageNotAssumed": "PASS",
    "scenarios": [
      "declared",
      "evidencePending",
      "dependenciesUnknown"
    ],
    "syntheticOnly": true
  }
}