Author the urgent remediation work package

Objectives

Halcyon Clinics has validated the report below. The release manager recommends only hiding the record button and assigning the tester as the service owner. Prepare the first work package for the highest-priority finding, keeping the report's traceability intact.

Use the fixture's exact identifiers and role labels. Describe a server-side control and a negative test of cross-patient access. Record the deadline window in hours, link the deployment and retest evidence, and keep the item pending independent verification rather than declaring closure from a release receipt.

Report AP-17, production appointment API, validated 2026-06-10T09:00:00Z.
AP-17-1: authenticated patient reads another patient's record; confirmed sensitive disclosure.
AP-17-2: reachable vulnerable parser; no sensitive-data access demonstrated.
AP-17-3: framework version banner only.
Priority policy: disclosure critical; parser high; banner low.
SLA elapsed hours from validation: critical 24, high 168, medium 720, low 2160.
Accountable service owner: patient-services. Delivery: api-engineering.
Independent verifier: security-assurance. Local control: APP-AC-01.
Deployed build evidence: deploy-431. Independent test run reserved: test-882.
Current state: change deployed, independent retest pending.
Required negative test: patient A requests patient B record; verify denial and no medical data.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Select the urgent record

   Compare the demonstrated consequences in the report and preserve the selected source identifier alongside its policy classification.

   Highest-risk finding and business priority retained

2. Step 2

   Carry the clock forward

   Read the elapsed-hour policy for the chosen class. A release event cannot change the start of that measurement.

   Critical elapsed-hour window preserved

3. Step 3

   Name the decision-makers

   Copy the accountable and implementing roles from the contract into their distinct fields; do not transfer ownership to the discoverer.

   Accountability separated from delivery

4. Step 4

   Describe the enforcement point

   Link the local access-control identifier and explain which trusted execution boundary must decide whether the caller may access the object.

   Control maps to server-side authorisation

5. Step 5

   Design a falsifying test

   Use different resource owners, require the forbidden operation to fail without returning protected fields, and name a verifier outside the delivery team.

   Independent cross-patient denial test specified

6. Step 6

   Avoid a premature green status

   Preserve both evidence references and choose a state that records the unfinished verification gate rather than implying the deployed change has been proven effective.

   Deployment and retest references retained without premature closure

Rules summary

• XP on pass

  60 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 15 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.