Operational Data Models

Entitlement Status

Compare Grant to Role

A role model can stay simple when it checks one grant against a small expected-permission list. The selector changes the role under review.

Program

Play the program to choose the role and inspect whether the grant is expected.

role
entitlement_status_model.dart
Replay: real traced execution (multi-file project)
void main() {
  var role = 'analyst';
  var grant = 'deploy';
  var allowed = role == 'admin' ? ['deploy', 'read'] : ['read'];
  var auditStatus = allowed.contains(grant) ? 'expected' : 'unexpected';
  var line = '$role grant=$grant status=$auditStatus';
  print(line);
}

void main() {
  var role = 'admin';
  var grant = 'deploy';
  var allowed = role == 'admin' ? ['deploy', 'read'] : ['read'];
  var auditStatus = allowed.contains(grant) ? 'expected' : 'unexpected';
  var line = '$role grant=$grant status=$auditStatus';
  print(line);
}

  1. role ← analyst

    1void main() {2  var role = 'analyst';3  var grant = 'deploy';
    values this stepanalystrole

  2. grant ← deploy

    2var role = 'analyst';3var grant = 'deploy';4var allowed = role == 'admin' ? ['deploy', 'read'] : ['read'];
    values this stepdeploygrant

  3. allowed ← read

    3var grant = 'deploy';4var allowed = role == 'admin' ? ['deploy', 'read'] : ['read'];5var auditStatus = allowed.contains(grant) ? 'expected' : 'unexpected';
    values this stepreadallowedanalystrole

  4. auditStatus ← unexpected

    4var allowed = role == 'admin' ? ['deploy', 'read'] : ['read'];5var auditStatus = allowed.contains(grant) ? 'expected' : 'unexpected';6var line = '$role grant=$grant status=$auditStatus';
    values this stepunexpectedauditStatusreadalloweddeploygrant

  5. line ← analyst grant=deploy status=unexpected

    5var auditStatus = allowed.contains(grant) ? 'expected' : 'unexpected';6var line = '$role grant=$grant status=$auditStatus';7print(line);
    values this stepanalyst grant=deploy status=unexpectedlineanalystroledeploygrantunexpectedauditStatus

  6. print(line);

    6  var line = '$role grant=$grant status=$auditStatus';7  print(line);8}
    outputanalyst grant=deploy status=unexpected
    values this stepanalyst grant=deploy status=unexpectedline

  1. role ← admin

    1void main() {2  var role = 'admin';3  var grant = 'deploy';
    values this stepadminrole

  2. grant ← deploy

    2var role = 'admin';3var grant = 'deploy';4var allowed = role == 'admin' ? ['deploy', 'read'] : ['read'];
    values this stepdeploygrant

  3. allowed ← deploy, read

    3var grant = 'deploy';4var allowed = role == 'admin' ? ['deploy', 'read'] : ['read'];5var auditStatus = allowed.contains(grant) ? 'expected' : 'unexpected';
    values this stepdeploy, readallowedadminrole

  4. auditStatus ← expected

    4var allowed = role == 'admin' ? ['deploy', 'read'] : ['read'];5var auditStatus = allowed.contains(grant) ? 'expected' : 'unexpected';6var line = '$role grant=$grant status=$auditStatus';
    values this stepexpectedauditStatusdeploy, readalloweddeploygrant

  5. line ← admin grant=deploy status=expected

    5var auditStatus = allowed.contains(grant) ? 'expected' : 'unexpected';6var line = '$role grant=$grant status=$auditStatus';7print(line);
    values this stepadmin grant=deploy status=expectedlineadminroledeploygrantexpectedauditStatus

  6. print(line);

    6  var line = '$role grant=$grant status=$auditStatus';7  print(line);8}
    outputadmin grant=deploy status=expected
    values this stepadmin grant=deploy status=expectedline
role selector `role` chooses which permission list is expected.
contains `allowed.contains(grant)` performs the membership check.
audit status The report labels the grant as expected or unexpected for the chosen role.