SECURITY · ACCESS INSPECTION DESK
Security tracing: locate the denying gate
Inspect credential claims, policy gates and the resource decision. Change a condition and follow the exact denial reason.
Your experiment
Create three simultaneous faults. Inspect which gate runs first and which later checks are skipped. Fix faults one at a time and predict the next denial.
Prediction is computed immediately; Play reveals each gate in order. A denial prevents every later gate from running. Capture a baseline before changing one field.
Illustrative claims
Decision trace
Offline policy exercise—not a JWT validator, OAuth server or production security boundary. Verification is an injected test result; no cryptography, real tokens, keys or records are used. Never rely on browser controls to enforce real authorization. Roles, gate order and strict same-tenant rules are application-specific assumptions, not universal OAuth requirements. Expiry is evaluated at a fixed instant; animation does not age the token. No revocation, clock skew or delegation is modeled. Bearer token reference · JWT claims reference.
Locate the first denying security gate
A security trace should explain the decision that actually occurred, without labeling unexecuted checks as failures. This fixture evaluates a credential against eight ordered gates and reveals each gate in the inspection desk. The visible decision and trace come from the same evaluation result. The exercise is local: it does not collect production logs, correlate distributed spans or observe another agent. Use it to distinguish an authentication failure from a tenant, scope or role denial before designing your own telemetry.
Supply the credential and resource facts
Bearer credential present and Trusted verification result control the first two authentication gates. The latter is an injected authenticator result, not an actual signature computation. Issuer selects a trusted or unknown issuer; Audience chooses this agent API or another API. Seconds until expiry is evaluated at a fixed instant, with zero already expired. Principal tenant and Resource tenant define the boundary. Role selects viewer, operator or admin; Requested action chooses read, write or delete. The read, write and delete scope checkboxes represent independently granted token scopes. Changing a fact resets inspection of the same ordered policy.
Diagnose multiple faults without losing their order
Disable Trusted verification result, set Principal tenant to team-a and Resource tenant to team-b, request delete and leave delete scope disabled. Finish the eight steps. Verification is the first denial and the remaining checks say not-run. Enable verification and replay: the denial moves to Tenant boundary. Match the resource tenant to team-a: Required scope now denies the request. Enable delete scope: viewer role still denies delete. Change Role to admin and the selected request passes. Each repair reveals the next relevant gate; the earlier traces are not evidence that later policies had already passed.
Design useful but bounded operational evidence
Record the failed gate name, selected operation and outcome when reasoning about this fixture. The claims panel is intentionally synthetic and fully visible for learning; do not copy that logging pattern into a real system with bearer secrets or personal claims. A single denied request does not establish an attack rate or service reliability. This model contains no aggregate counters, trace sampling or security alert threshold. Restarting playback repeats the selected decision rather than submitting another API request.
Inspect first denial and later gates
The desk evaluates token presence, verification, issuer, audience, expiry, tenant, required scope and role in that order. The first denial determines the displayed HTTP result. Later gates are not-run, not additional failures or successful checks. The credential JSON and policy preview describe the complete selected scenario before animation finishes. Play reveals eight gates over thirty-two seconds at normal speed; Pause holds progress, Step advances one gate, Restart rewinds and Speed chooses half, normal or double inspection pace. Edits start playback unless reduced motion is requested. The resource vault opens only after inspection reaches the final decision and every required policy has passed.
Keep the security boundary explicit
This is a deterministic application authorization policy over fixture claims. It does not parse a JWT, retrieve a JWK, verify a cryptographic signature, issue an OAuth token, run a real identity provider or contact a protected endpoint. The verification checkbox is evidence supplied to the policy, not a way to bypass real cryptography. Expiry is not a live countdown; no clock skew, refresh flow, revocation, multiple audiences or scope hierarchy is implemented. Admin privileges are tenant-local in this fixture. HTTP 401 and 403 are the chosen teaching policy outcomes, not a claim that every provider uses this exact gate order or error text.