[
 {
  "probe": "db-probe",
  "category": "database",
  "description": "Connects to the app database as its identity (no password) and reads/writes. Red = the database, grant or network chain is broken.",
  "state": "green",
  "detail": "passing",
  "restarts": 7,
  "lastLog": "2026-07-24T04:08:53Z PASS postgres ddl/write/read as MI (mid-platme-test-dev-backend-2001b20a@psql-bis-plm-aue-np-dev.postgres.database.azure.com/platme-test-dev-appdb)"
 },
 {
  "probe": "deny-db-probe",
  "category": "database",
  "description": "An identity with no grant must be refused by the database. Red = access is leaking past the grants.",
  "state": "green",
  "detail": "passing",
  "restarts": 0,
  "lastLog": "2026-07-24T04:13:32Z PASS ungranted identity refused by postgres (mid-platme-test-dev-denied-a050eae3)"
 },
 {
  "probe": "scoped-db-probe",
  "category": "database",
  "description": "Read-only grant: reads work, writes refused. Red = role limits not enforced.",
  "state": "green",
  "detail": "passing",
  "restarts": 7,
  "lastLog": "2026-07-24T04:08:42Z PASS reader role scope enforced (read OK, write denied)"
 },
 {
  "probe": "deny-probe",
  "category": "key-vault",
  "description": "An identity with no grant must be refused by the vault. Red = access is leaking past the grants.",
  "state": "green",
  "detail": "passing",
  "restarts": 0,
  "lastLog": "2026-07-24T04:09:47Z PASS ungranted identity denied by vault"
 },
 {
  "probe": "kv-probe",
  "category": "key-vault",
  "description": "Reads a vault secret as the app identity. Red = the identity or its vault grant is broken.",
  "state": "green",
  "detail": "passing",
  "restarts": 0,
  "lastLog": "2026-07-24T04:09:48Z PASS kv read via workload identity"
 },
 {
  "probe": "scoped-probe",
  "category": "key-vault",
  "description": "Grant limited to one secret: that one readable, all others denied. Red = scoping not enforced.",
  "state": "green",
  "detail": "passing",
  "restarts": 0,
  "lastLog": "2026-07-24T04:10:57Z PASS per-secret scope enforced (in-scope read OK, out-of-scope denied)"
 },
 {
  "probe": "deny-storage-probe",
  "category": "storage",
  "description": "An identity with no grant must be refused by the storage account. Red = access is leaking past the grants.",
  "state": "green",
  "detail": "passing",
  "restarts": 0,
  "lastLog": "2026-07-24T04:12:21Z PASS ungranted identity denied by storage"
 },
 {
  "probe": "scoped-storage-probe",
  "category": "storage",
  "description": "Read-only grant: reads work, writes refused. Red = role limits not enforced.",
  "state": "green",
  "detail": "passing",
  "restarts": 7,
  "lastLog": "2026-07-24T04:10:52Z PASS reader role scope enforced (read OK, write denied)"
 },
 {
  "probe": "storage-probe",
  "category": "storage",
  "description": "Writes and reads a blob as the app identity. Red = the container, grant or network chain is broken.",
  "state": "green",
  "detail": "passing",
  "restarts": 5,
  "lastLog": "2026-07-24T04:08:46Z PASS blob write/read/list as MI (stplmauenpdev/platme-test-dev-appdata)"
 }
]