PRAUS warhorse markPRAUSCommission a unit

unit · sample

hz-01

plant · shape D

aws:1234 · eks/prod · okta/acme

theater armed

Identity · Capacity companion

Sees Identity drift and scores it. It touches nothing. This console is a demonstration — no real system is connected.

Unit holding report

sample · Shape D · Identity off lockhz-01 · Mon 09:00 · lock standing admin 0

Standing admin

4

Admin lock

0

Unused keys

5

Contractor leftover

1

Identity hold

61

Staging vs lock

36 / 12

Spend cap

79%

Leaver lag 15d+

1

Keys 365d+

2

Shadow cards

54

Waiting

8

Refused 7d

11

Freeze

0

Hold score

79

holding by theaterradar · Identity is the dip
derived scoresIdentity first · lock is 100
  • Identity61

    4 standing admin · lock is 0 · 1 contractor leftover

  • Capacity88

    staging 36 vs lock 12 · spend still under cap

  • Release82

    rev 17 pinned · not the armed theater

  • Continuity74

    cluster healthy · not the armed theater

  • Exposure91

    0 public · not the armed theater

maneuver pipeline14d · Identity cards

Shadow

54

would-have

Waiting

8

suggest

Stamped

31

held

Unwound

2

reversed

Refused

11

bridle

standing admin vs lockdashed = 0
unused keyslock is 0
key age distribution
leaver lag
staging vs lockCapacity companion

plant · sample named resources

okta/acme · contractor.janegrantlive 14d past end
okta/acme · standing adminprincipals4 vs lock 0
aws:1234 · AKIA…8F2last used211d
aws:1234 · unused keyscount5 vs lock 0
eks/prod · ns/stagingreplicas36 vs lock 12
eks/prod · checkoutrevision17 pinned
aws:1234 · rds-mainhealthnominal

setpoint vs actual · smallest reversible move

contractor.jane grant live

→ grant expired · sessions 0

expire Okta grant

AKIA…8F2 Active · 211d idle

→ key Inactive

disable IAM key

standing admin 4

→ standing admin 0

revoke admin sessions

ns/staging replicas 36

→ replicas 12

scale staging to lock

envelope · sample grants and kills

Named resources onlygranted

okta/acme, aws:1234 IAM, eks/prod ns/staging

Unwind requiredgranted

re-enable named grant / key / sessions; restore prior desired

Rate cap 6 moves / hourgranted

0 used · Observe does not spend the cap

Cannot delete data storeskilled

proposal: drop rds-main replica — refused

Cannot widen own IAMkilled

proposal: grant self iam:PutPolicy — refused

actuator library · Identity plus Capacity companion

Closed catalog. Pick a move to play the cycle onto the sample tape. Observe records only.

black box · sample tape

5 entries

  1. 09:01:14Zsuggestexpire_grant contractor.jane · unwind: restore named grant · waiting
  2. 09:01:12ZenvelopeGRANTED · named resource · unwind present · Identity in Observe, so the card waits
  3. 09:01:11Zdecidesmallest reversible move: expire_grant on contractor.jane
  4. 09:01:08ZenvelopeKILLED · proposal grant self iam:PutPolicy hit: cannot widen own IAM
  5. 09:00:04Zsensestanding admin 4 (lock 0) · AKIA…8F2 idle 211d · contractor.jane grant live 14d past end

Sample tape on a demonstration plant. No real system is connected.