Frame the decision
Define the launch, customer commitment, or architecture decision the evidence must support.
Controlled verification method
Test the authority question without creating a new one.
LuxlyNight separates assessment authorization—the permission to test—from agent authority—the behavior the system permits. Both must be explicit, but they are not the same thing.
The sequence
Intended policy → observed behavior → decision evidence.
Map intended authority
Document actors, tenants, delegated tasks, identities, tools, destinations, credentials, and allowed actions.
Verify observed behavior
Exercise approved allow-and-deny paths, capture evidence, and investigate discrepancies without expanding scope by implication.
Close the decision
Deliver the agreed engineering evidence, decision support, remediation priorities, and retest record where included in scope.
Assessment authorization
No ambiguity about permission.
An inquiry, form, meeting, or verbal request never authorizes active testing.
01
Named system owner and decision-maker
REQUIRED02
Exact systems, identities, tenants, tools, and test window
REQUIRED03
Permitted methods and explicit exclusions
REQUIRED04
Operational contacts and stop-testing conditions
REQUIRED05
Evidence handling, retention, and deletion rules
REQUIRED06
Written approval before the scope changes
REQUIREDModel intended authority
Translate architecture and policy into testable relationships: actor, tenant, delegated task, identity, tool, credential, destination, action, approval, and expected decision.
Design allow and deny cases
Test success paths and prohibited behavior. Deny cases include cross-user, cross-tenant, expired or revoked identity, parameter manipulation, alternate tools, destinations, and unsafe state transitions.
Capture the decision chain
Collect enough context to explain not only what occurred but which identity and control made the result possible, with timestamps and limitations.
Report uncertainty
State coverage, assumptions, inaccessible paths, evidence quality, and what the engagement cannot establish. Scoped evidence is not universal assurance.
Method in practice