| database |
| db-probeⓘConnects to the app database as its identity (no password) and reads/writes. Red = the database, grant or network chain is broken. | passing | 7 | 2026-07-24T03:23:50Z PASS postgres ddl/write/read as MI (mid-platme-test-dev-backend-2001b20a@psql-bis-plm-aue-np-dev.postgres.database.azure.com/platme-test-dev-appdb) |
| deny-db-probeⓘAn identity with no grant must be refused by the database. Red = access is leaking past the grants. | passing | 0 | 2026-07-24T03:23:10Z PASS ungranted identity refused by postgres (mid-platme-test-dev-denied-a050eae3) |
| scoped-db-probeⓘRead-only grant: reads work, writes refused. Red = role limits not enforced. | passing | 7 | 2026-07-24T03:23:40Z PASS reader role scope enforced (read OK, write denied) |
| key-vault |
| deny-probeⓘAn identity with no grant must be refused by the vault. Red = access is leaking past the grants. | passing | 0 | 2026-07-24T03:23:45Z PASS ungranted identity denied by vault |
| kv-probeⓘReads a vault secret as the app identity. Red = the identity or its vault grant is broken. | passing | 0 | 2026-07-24T03:23:46Z PASS kv read via workload identity |
| scoped-probeⓘGrant limited to one secret: that one readable, all others denied. Red = scoping not enforced. | passing | 0 | 2026-07-24T03:24:19Z PASS per-secret scope enforced (in-scope read OK, out-of-scope denied) |
| storage |
| deny-storage-probeⓘAn identity with no grant must be refused by the storage account. Red = access is leaking past the grants. | no available replicas | 0 | |
| scoped-storage-probeⓘRead-only grant: reads work, writes refused. Red = role limits not enforced. | no available replicas | 0 | |
| storage-probeⓘWrites and reads a blob as the app identity. Red = the container, grant or network chain is broken. | no available replicas | 0 | |