Capstone Thread

Add asset inventory, data-flow and trust-boundary diagram, misuse cases, cryptographic decision record, identity lifecycle, session contract, authorization matrix, workload identity, secret inventory, rotation drill, and residual-risk statement.

Required evidence

Submit diagrams, versioned configuration, runnable positive and negative tests, audit events, one rejected design, remediation record, and residual-risk owner. Scanner output without mechanism-level triage does not pass.

Oral defense

Name the attacker and asset, explain the exact control property, demonstrate a denied misuse case, and execute revocation or safe recovery.

Source backbone

Use NIST SP 800-63, OWASP ASVS, relevant RFCs, and Building Secure and Reliable Systems.