Operational Status Reports

Entitlement Status

Compare Grants to Role

A shell report can model a simple entitlement check with scalar role, grant, and status values.

Program

Play the script to choose the role and inspect whether the grant is expected.

role
entitlement_status_report.sh
Replay: real traced execution (multi-file project)
#!/usr/bin/env bash

role="analyst"
grant="deploy"
if [[ "$role" == "admin" ]]; then
    allowed="deploy read"
else
    allowed="read"
fi
if [[ " $allowed " == *" $grant "* ]]; then
    audit_status="expected"
else
    audit_status="unexpected"
fi
echo "$role grant=$grant status=$audit_status"

#!/usr/bin/env bash

role="admin"
grant="deploy"
if [[ "$role" == "admin" ]]; then
    allowed="deploy read"
else
    allowed="read"
fi
if [[ " $allowed " == *" $grant "* ]]; then
    audit_status="expected"
else
    audit_status="unexpected"
fi
echo "$role grant=$grant status=$audit_status"

  1. role ← analyst

    3role="analyst"4grant="deploy"
    values this stepanalystrole

  2. grant ← deploy

    3role="analyst"4grant="deploy"5if [[ "$role" == "admin" ]]; then
    values this stepdeploygrant

  3. if [[ "$role" == "admin" ]]; then

    4grant="deploy"5if [[ "$role" == "admin" ]]; then6    allowed="deploy read"
    values this stepanalystrole

  4. allowed ← read

    7else8    allowed="read"9fi
    values this stepreadallowed

  5. if [[ " $allowed " == *" $grant "* ]]; then

    9fi10if [[ " $allowed " == *" $grant "* ]]; then11    audit_status="expected"
    values this stepreadalloweddeploygrant

  6. audit_status ← unexpected

    12else13    audit_status="unexpected"14fi
    values this stepunexpectedaudit_status

  7. echo "$role grant=$grant status=$audit_status"

    14fi15echo "$role grant=$grant status=$audit_status"
    outputanalyst grant=deploy status=unexpected
    values this stepanalystroledeploygrantunexpectedaudit_status

  1. role ← admin

    3role="admin"4grant="deploy"
    values this stepadminrole

  2. grant ← deploy

    3role="admin"4grant="deploy"5if [[ "$role" == "admin" ]]; then
    values this stepdeploygrant

  3. if [[ "$role" == "admin" ]]; then

    4grant="deploy"5if [[ "$role" == "admin" ]]; then6    allowed="deploy read"
    values this stepadminrole

  4. allowed ← deploy read

    5if [[ "$role" == "admin" ]]; then6    allowed="deploy read"7else
    values this stepdeploy readallowed

  5. if [[ " $allowed " == *" $grant "* ]]; then

    9fi10if [[ " $allowed " == *" $grant "* ]]; then11    audit_status="expected"
    values this stepdeploy readalloweddeploygrant

  6. audit_status ← expected

    10if [[ " $allowed " == *" $grant "* ]]; then11    audit_status="expected"12else
    values this stepexpectedaudit_status

  7. echo "$role grant=$grant status=$audit_status"

    14fi15echo "$role grant=$grant status=$audit_status"
    outputadmin grant=deploy status=expected
    values this stepadminroledeploygrantexpectedaudit_status
role policy The role chooses the permissions that are expected for the check.
grant comparison The membership test compares one grant against the role policy string.
audit status The final status calls out whether the grant matches the selected role.