Triage the policy decision log

Objectives

The OPA decision log for the last hour holds eight entries. Production is being deployed to continuously and the policy has just been widened.

Raise the decisions that mean the policy failed to protect production. Leave the ones that are working as intended.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

D-1  deny bypassed: request carried break_glass=true; no incident id, no expiry, allowed.
D-2  allow: request matched an exemption rule whose expiry field is set to the year 2099.
D-3  deny: public storage bucket blocked, developer notified.
D-4  allow: policy evaluated against an empty input document; default allow returned.
D-5  deny: untagged resource blocked.
D-6  allow: rule uses "not deny" with a typo'd rule name, so the guard never fires.
D-7  allow: compliant deployment, all rules evaluated, decision logged with policy hash.
D-8  deny: two rules disagreed; conflict resolved to deny and logged for review.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the fixture as a population, not a list

   Policy as code is only as strong as its default and its guards. Read every allow decision and ask which rule actually approved it.

2. Step 2

   Decide what actually qualifies

   Four allows are unsafe: an unbounded break-glass, an exemption that never expires, a default allow on empty input, and a guard that cannot fire because its name never resolves.

   The right findings are raised

3. Step 3

   Resist the loud lines

   The four denies, including the conflicted one, are the system working. Raising them wastes the reviewer's attention on correct behaviour.

   Benign lines are left out

4. Step 4

   Grade the exposure, not the wording

   A default allow is the most severe: it approves everything the policy failed to parse, which is unbounded by definition.

   A silently dead guard sits just under it, then an unbounded break-glass, then a long-dated exemption, which at least appears in the exemption register.

   Severity matches the actual exposure

5. Step 5

   Rank so the first line is the one you act on

   Rank by breadth of exposure, not by how alarming the log line reads.

   Ranked worst first

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.