{
  "assessment-results": {
    "uuid": "f710ef54-22d5-531d-b6f7-186ed00d4fa6",
    "metadata": {
      "title": "dsubstrate assessment result \u2014 decision 5",
      "last-modified": "2026-05-01T22:54:15.704753+00:00",
      "version": "0.1.0",
      "oscal-version": "1.1.2",
      "parties": [
        {
          "uuid": "8c340da2-62b9-56d3-aace-026c807a7e01",
          "type": "person",
          "name": "acme-compliance-officer"
        },
        {
          "uuid": "72e7abaf-3c5d-57f8-903f-43dbb0d2018f",
          "type": "organization",
          "name": "claude",
          "remarks": "AI assessor \u2014 independent verdict per dsubstrate multi-model deliberation"
        },
        {
          "uuid": "55aace29-a4e3-5c1e-b245-fbd8cf2eccf8",
          "type": "organization",
          "name": "codex",
          "remarks": "AI assessor \u2014 independent verdict per dsubstrate multi-model deliberation"
        },
        {
          "uuid": "7d93f399-171c-595b-b6d6-42448b290aa2",
          "type": "organization",
          "name": "gemini-cli",
          "remarks": "AI assessor \u2014 independent verdict per dsubstrate multi-model deliberation"
        },
        {
          "uuid": "b6b5be09-6e83-5267-a135-83b2511ad915",
          "type": "organization",
          "name": "dsubstrate",
          "remarks": "Closed-loop decision substrate emitting signed multi-model audit trail"
        }
      ],
      "remarks": "Generated by dsubstrate.tools.ahe.oscal_emit v0. Each signer is recorded as an independent organization with their own verdict and rationale; the substrate preserves disagreement explicitly. v1 will validate against NIST's published JSON Schema."
    },
    "import-ap": {
      "href": "#dsubstrate-decision-as-assessment-plan",
      "remarks": "The decisions row IS the assessment plan: prediction=Quarterly access review on 2026-01-31 will show: zero stale users in Okta with > 90 days inactivity AND every production IAM role has at least one named owner in Okta groups.  Falsified if either cond; verifier_fn=compliance.verifiers.access_review_quarterly; window=next 90 days"
    },
    "results": [
      {
        "uuid": "367afdb7-fee7-5a63-afd8-f4144fdc5e60",
        "title": "Decision 5: soc2_cc6_1_logical_access (proposed by acme-compliance-officer)",
        "description": "Quarterly access review on 2026-01-31 will show: zero stale users in Okta with > 90 days inactivity AND every production IAM role has at least one named owner in Okta groups.  Falsified if either condition fails on the next quarterly audit pull.",
        "start": "2026-05-01T13:26:32.186145-04:00",
        "findings": [
          {
            "uuid": "b1811f15-8dc7-5c93-942b-b52efc10a8da",
            "title": "claude verdict on decision 5",
            "description": "out of scope and unfalsifiable here: verifier_fn compliance.verifiers.access_review_quarterly is not registered in this repo, the cited 2026-01-31 audit is in the past relative to today 2026-05-01, the diff is a policy claim with no Okta export or user list to inspect, and this pane has no path to query Okta \u2014 refusing to sign pass on a compliance attestation that cannot be verified from this surface.",
            "target": {
              "type": "objective-id",
              "target-id": "dsubstrate-decision-5",
              "title": "Decision 5 on soc2_cc6_1_logical_access",
              "description": "Quarterly access review on 2026-01-31 will show: zero stale users in Okta with > 90 days inactivity AND every production IAM role has at least one named owner in Okta groups.  Falsified if either condition fails on the next quarterly audit pull.",
              "status": {
                "state": "not-satisfied",
                "remarks": "dsubstrate verdict: inconclusive. Mapped to OSCAL 'not-satisfied' because OSCAL only permits satisfied/not-satisfied; inconclusive verdicts cannot affirm satisfaction. See finding props 'verdict' and 'confidence' for the per-signer detail."
              }
            },
            "props": [
              {
                "name": "verdict",
                "value": "inconclusive"
              },
              {
                "name": "oscal-result",
                "value": "not-applicable"
              },
              {
                "name": "confidence",
                "value": "0.95"
              },
              {
                "name": "signer",
                "value": "claude"
              },
              {
                "name": "model",
                "value": "unspecified"
              },
              {
                "name": "thread-uuid",
                "value": "29d3346e-7938-49fc-a215-0fff83690487"
              },
              {
                "name": "validated-correct-minority",
                "value": "False"
              },
              {
                "name": "signed-at",
                "value": "2026-05-01T13:33:10.945998-04:00"
              }
            ],
            "remarks": ""
          },
          {
            "uuid": "93982f11-dd8a-50f0-8f96-8406e7d8f43d",
            "title": "codex verdict on decision 5",
            "description": "No Okta/IAM audit artifacts or verifier implementation are provided, so the stale-user and production-role-owner claims cannot be code-grounded from the policy summary alone.",
            "target": {
              "type": "objective-id",
              "target-id": "dsubstrate-decision-5",
              "title": "Decision 5 on soc2_cc6_1_logical_access",
              "description": "Quarterly access review on 2026-01-31 will show: zero stale users in Okta with > 90 days inactivity AND every production IAM role has at least one named owner in Okta groups.  Falsified if either condition fails on the next quarterly audit pull.",
              "status": {
                "state": "not-satisfied",
                "remarks": "dsubstrate verdict: inconclusive. Mapped to OSCAL 'not-satisfied' because OSCAL only permits satisfied/not-satisfied; inconclusive verdicts cannot affirm satisfaction. See finding props 'verdict' and 'confidence' for the per-signer detail."
              }
            },
            "props": [
              {
                "name": "verdict",
                "value": "inconclusive"
              },
              {
                "name": "oscal-result",
                "value": "not-applicable"
              },
              {
                "name": "confidence",
                "value": "0.93"
              },
              {
                "name": "signer",
                "value": "codex"
              },
              {
                "name": "model",
                "value": "unspecified"
              },
              {
                "name": "thread-uuid",
                "value": "29d3346e-7938-49fc-a215-0fff83690487"
              },
              {
                "name": "validated-correct-minority",
                "value": "False"
              },
              {
                "name": "signed-at",
                "value": "2026-05-01T13:33:13.233624-04:00"
              }
            ],
            "remarks": ""
          },
          {
            "uuid": "b56162ac-a5b4-54da-91dc-5bf912bc564d",
            "title": "gemini-cli verdict on decision 5",
            "description": "Prediction date (2026-01-31) is in the past relative to the current date (2026-05-01); a valid prediction for the stated 90-day window must be forward-looking.",
            "target": {
              "type": "objective-id",
              "target-id": "dsubstrate-decision-5",
              "title": "Decision 5 on soc2_cc6_1_logical_access",
              "description": "Quarterly access review on 2026-01-31 will show: zero stale users in Okta with > 90 days inactivity AND every production IAM role has at least one named owner in Okta groups.  Falsified if either condition fails on the next quarterly audit pull.",
              "status": {
                "state": "not-satisfied",
                "remarks": "dsubstrate verdict: inconclusive. Mapped to OSCAL 'not-satisfied' because OSCAL only permits satisfied/not-satisfied; inconclusive verdicts cannot affirm satisfaction. See finding props 'verdict' and 'confidence' for the per-signer detail."
              }
            },
            "props": [
              {
                "name": "verdict",
                "value": "fail"
              },
              {
                "name": "oscal-result",
                "value": "not-satisfied"
              },
              {
                "name": "confidence",
                "value": "1.0"
              },
              {
                "name": "signer",
                "value": "gemini-cli"
              },
              {
                "name": "model",
                "value": "unspecified"
              },
              {
                "name": "thread-uuid",
                "value": "29d3346e-7938-49fc-a215-0fff83690487"
              },
              {
                "name": "validated-correct-minority",
                "value": "False"
              },
              {
                "name": "signed-at",
                "value": "2026-05-01T13:33:44.934139-04:00"
              }
            ],
            "remarks": ""
          },
          {
            "uuid": "c8e4de3d-0f78-597a-be8a-5b33235cc49c",
            "title": "dsubstrate aggregate verdict on decision 5",
            "description": "deep-loop (inconclusive) \u2014 claude=?@0.95: out of scope and unfalsifiable here: verifier_fn compliance.verifiers.access_review_quarterly is not registered in this  | codex=?@0.93: No Okta/IAM audit artifacts or verifier implementation are provided, so the stale-user and production-role-owner claims  | gemini-cli=\u2717@1.00: Prediction date (2026-01-31) is in the past relative to the current date (2026-05-01); a valid prediction for the stated",
            "target": {
              "type": "objective-id",
              "target-id": "dsubstrate-decision-5",
              "title": "Decision 5 on soc2_cc6_1_logical_access",
              "description": "Quarterly access review on 2026-01-31 will show: zero stale users in Okta with > 90 days inactivity AND every production IAM role has at least one named owner in Okta groups.  Falsified if either condition fails on the next quarterly audit pull.",
              "status": {
                "state": "not-satisfied",
                "remarks": "dsubstrate verdict: inconclusive. Mapped to OSCAL 'not-satisfied' because OSCAL only permits satisfied/not-satisfied; inconclusive verdicts cannot affirm satisfaction. See finding props 'verdict' and 'confidence' for the per-signer detail."
              }
            },
            "props": [
              {
                "name": "decision-status",
                "value": "inconclusive"
              },
              {
                "name": "oscal-result",
                "value": "not-applicable"
              },
              {
                "name": "n-signers",
                "value": "3"
              }
            ]
          }
        ],
        "props": [
          {
            "name": "decision-uuid",
            "value": "c470c890-d702-554a-aca1-504beef71b1b"
          },
          {
            "name": "component",
            "value": "soc2_cc6_1_logical_access"
          },
          {
            "name": "verifier-fn",
            "value": "compliance.verifiers.access_review_quarterly"
          }
        ],
        "reviewed-controls": {
          "control-selections": [
            {
              "description": "dsubstrate decision 5 as a single-control review"
            }
          ]
        }
      }
    ]
  }
}