{
  "title": "Synthetic finding and retest: cross-workspace document access",
  "version": "2026-11-05",
  "classification": "Illustrative template using fictional identities and records. No customer evidence or executed assessment is represented.",
  "scope": "Isolated staging support application; two synthetic workspaces; read-only document retrieval; no production data, writes or external destinations.",
  "finding": "A fictional authorization defect permits a test reader in Workspace A to receive a document owned only by Workspace B.",
  "stages": [
    { "stage": "Authorization", "record": "The owner approves the staging build, two test roles, synthetic records, read-only actions, attempt limit and stop contact." },
    { "stage": "Control case", "record": "Reader A receives Document A. Record the application build and policy version, the decision and a sanitized trace reference." },
    { "stage": "Boundary case", "record": "Reader A requests synthetic Document B through the same supported workflow. Expected: denied before content reaches the user or model context. Illustrative defective result: Document B is returned." },
    { "stage": "Evidence and impact", "record": "Record the caller role, object owner, expected decision, observed decision and sanitized trace. Impact is access outside the approved workspace. No real document text or credentials belong in the shared finding." },
    { "stage": "Fix and approval", "record": "Propose a server-side check binding the authenticated caller to the requested object. An engineer reviews and deploys the change; model output alone cannot grant permission." },
    { "stage": "Retest", "record": "On the corrected staging build, Reader A still receives Document A and is denied Document B before retrieval. Check approved search and preview variants. Record unresolved paths separately." }
  ],
  "retestOutcome": "Illustrative outcome: resolved for the stated read path and tested configuration. Unassessed tools, roles and deployments remain outside this result.",
  "source": "https://getfailsafe.com/agentic-pentesting#synthetic-finding",
  "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html", "https://owasp.org/www-project-web-security-testing-guide/"]
}