SFS C / SF B

Back to SFS C

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are all organization-owned service interfaces configured to return only information explicitly permitted for the client's authorization level throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Interfaces consistently filter response data to match client authorization boundaries

Assessment criterion and evidence

Actor: organization-owned service interfaces. Scope: API responses and data exchange mechanisms. Evidence period: throughout the review period. Required evidence: Documented interface configuration showing authorization-aware response filtering; Test results verifying response content adheres to authorization constraints. Negative criterion: Interfaces disclose data beyond client authorization scope. Missing evidence: Pending assessment due to unavailable configuration records

View the JSON record (opens in a new tab).

Assessment result: unset.