grceng.academy
YAML lab 60 bonus XP

Capstone: automate access removal end to end

Start labRead the room

Objectives

The auditor's one repeated finding is terminated staff keeping access. Your VP proposes a monthly reminder for IT to "check the leavers list".

Build the automated control instead: it joins two systems, asserts a deadline, stores immutable evidence, maps to the framework, and tests the full population. This capstone is the whole platform in one artefact.

Programme facts and identifier options

Requirement: access is removed within 24 hours of termination.

Systems: hris-api (termination records), okta-api (accounts and
sessions), jira-api (tickets), confluence (pages)

Framework identifier options:
  soc2:      CC6.2, CC6.6, CC7.2
  iso27001:  A.5.17, A.5.18, A.8.32
  nist80053: AC-2, IA-2, CM-3

Terminations in the audit period: 214 (the HRIS API returns all).
Evidence retention agreed with the audit firm: 7 years.
Frequency vocabulary: daily, weekly, monthly, quarterly, annually
Test methods: population | random_sample | judgemental

Checks the server runs (6)

  • Stable id, team owner, enum frequency
  • Joins the two systems that hold the answer
  • Assertion states the 24-hour deadline
  • Evidence is immutable and retained seven years
  • Mapped to the access-deprovisioning identifiers
  • Full population with a hard pass criterion

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Re-read the brief and name the trap

    A monthly reminder cannot enforce a 24-hour requirement; on average it finds the breach two weeks late. Cadence has to be at least as tight as the deadline being asserted.

    Work through the artefact section by section: each one is a habit from an earlier room in the track.

  2. Step 2

    Identity and cadence

    An uppercase hyphenated id, a durable team handle rather than a department abbreviation in quotes, and a frequency from the fixture's vocabulary that can actually catch a one-day breach.

    Stable id, team owner, enum frequency

  3. Step 3

    Name both sources

    Ask which system knows the termination event and which knows the account state. The control exists precisely because those two live apart.

    A wiki page is neither.

    Joins the two systems that hold the answer

  4. Step 4

    Put the deadline in the assertion

    "Promptly" is not a deadline. State the condition over the joined population with the numeric window from the requirement, so the evaluator can decide true or false without judgement.

    Assertion states the 24-hour deadline

  5. Step 5

    Evidence that survives challenge

    Two properties matter: nobody can edit a stored result after the fact, and results outlive the audit that asked for them. Convert the agreed retention into the unit this field uses.

    Evidence is immutable and retained seven years

  6. Step 6

    Map and test

    One identifier per framework from the options, choosing the ones about registration and deregistration of access rather than authentication strength or change control.

    Then, since the HRIS API returns every termination, drop sampling entirely and state a threshold rather than an adverb.

    Mapped to the access-deprovisioning identifiersFull population with a hard pass criterion

Rules summary

  • XP on pass

    60 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 15 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.