Control CoreDocs

PBAC Operator Playbooks

These playbooks are optimized for remote support handoff and deterministic diagnosis.

1) Policy Not Working

  • Confirm policy scope, environment, and binding target.
  • Verify required attributes are present in the request context.
  • Compare expected policy version with active commit/version.
  • Use denial replay to identify first failing branch.

2) No Bouncer or Resource Detected

  • Check bouncer registration and heartbeat freshness.
  • Validate resource-to-bouncer mapping.
  • Confirm Policy Bridge config and sync status for the target bouncer.
  • Re-run topology discovery after config correction.

3) Slow Policy Evaluation

  • Inspect p95/p99 decision latency in the incident window.
  • Check policy/module count and trace depth.
  • Identify context-fetch dependencies and timeout behavior.
  • Validate no stale/duplicate policy modules are loaded.

4) Policy Bridge Sync or Policy Freshness Issues

  • Compare Control Plane bundle hash with bouncer active hash.
  • Review sync failure/partial events and timestamps.
  • Validate repo path/branch credentials and filter scopes.
  • Trigger controlled resync and verify parity.

5) Masking/Redaction Behavior Issues

  • Confirm active masking policy exists in the loaded bundle.
  • Verify role/classification attributes in decision input.
  • Check mutation selection and field path coverage.
  • Distinguish masked-by-policy fields from absent-data fields.

6) Shadow → Enforce graduation

Use when moving from audit-only to blocking.

  1. Confirm shadow health: /health/ready, OPAL_SYNC_COMPLETED, recent SHADOW_WOULD_DENY.
  2. Run What-If POST /v1/compliance/impact-preview — record would_block_percent.
  3. Promote candidate control to sandbox; switch sandbox Bouncer to enforce.
  4. Verify OPAL; promote to production in change window; collect post-enforce DENY/mask evidence.

Full steps: Upgrade to enforce.

Evidence checklists (shadow → enforce)

Shadow pilot evidence

  • BOUNCER_ENFORCEMENT_MODE=shadow on pilot Bouncer
  • Feature flags: Integrity pilot, compliance dashboard, shadow enforcement
  • Sample SHADOW_WOULD_DENY JSON retained (mode, evaluation, matched_rule, risk_level, details)
  • Upstream still 200 on would-deny paths (upstream_forwarded: true)
  • Compliance pack selection recorded
  • Gap report + optional PDF/JSON compliance report

Pre-enforce evidence

  • Gap sign-off (critical/high triaged; CANNOT_ASSESS dispositioned)
  • Impact-preview / What-If output attached to change record
  • Sandbox enforce test results (deny/mask + public path pass-through)
  • OPAL_SYNC_COMPLETED for target Bouncers
  • Enforce-capable license applied

Post-enforce evidence

  • Live DENY/mask audit events for intended controls
  • No unexpected activation tax on unrelated routes
  • Latency within SLO (p99)
  • Updated compliance export archived

Clause mapping reference: SOC 2 CC6.1, Law 25 §12, PIPEDA 4.7, CPCSC L2, OSFI B-13 §3 — see Compliance report.