TenantAtlas/specs/128-rbac-baseline-compare/data-model.md

Data Model — Intune RBAC Baseline Compare & Findings v1

Entities

Foundation Type Baseline Metadata

Config-defined metadata controlling whether a foundation type can participate in baseline compare.

• Source: config/tenantpilot.php foundation rows, exposed through InventoryPolicyTypeMeta
• Required additions:
  • explicit baseline-compare support flag
  • optional compare identity strategy marker
  • optional summary kind or compare label metadata if needed for consistent rendering
• Required behavior:
  • intuneRoleDefinition is baseline-supported
  • intuneRoleAssignment is baseline-unsupported

Baseline Scope Entry

The workspace-owned selection stored in BaselineProfile.scope_jsonb.

• Existing structure:
  • policy_types[]
  • foundation_types[]
• New business rule:
  • foundation_types[] may contain intuneRoleDefinition
  • foundation_types[] must not contain intuneRoleAssignment through normal selection paths
• Validation:
  • selected foundation types must exist in canonical metadata
  • only baseline-supported foundation types are accepted

InventoryItem for Intune Role Definition

Tenant-owned latest-observed RBAC state used as the current compare anchor.

• Existing model/table: InventoryItem
• Ownership:
  • workspace_id NOT NULL
  • tenant_id NOT NULL
• Identity:
  • tenant_id + policy_type + external_id
  • for this feature, external_id is the primary compare identity
• Relevant fields:
  • policy_type = intuneRoleDefinition
  • external_id
  • display_name
  • category = RBAC
  • platform = all
  • meta_jsonb.is_built_in
  • meta_jsonb.role_permission_count
  • last_seen_at
  • last_seen_operation_run_id

PolicyVersion for Intune Role Definition

Immutable RBAC snapshot evidence reused for baseline references and diff rendering.

• Existing model/table: PolicyVersion
• Relevant fields:
  • tenant_id
  • policy_id
  • policy_type = intuneRoleDefinition
  • snapshot with Role Definition payload
  • captured_at
  • version_number
• Invariant:
  • enough data exists to normalize display name, description, built-in/custom state, and permissions without live Graph calls

Baseline Snapshot Item for Intune Role Definition

Workspace-owned approved baseline reference used during compare.

• Existing model/table: BaselineSnapshotItem
• Relevant fields:
  • baseline_snapshot_id
  • subject_type = policy or a role-definition-specific variant if introduced narrowly
  • subject_external_id as workspace-safe reference
  • subject_key upgraded to support stable Role Definition identity semantics
  • policy_type = intuneRoleDefinition
  • baseline_hash
  • meta_jsonb.display_name
  • meta_jsonb.evidence.*
  • meta_jsonb.identity.external_id or equivalent explicit identity marker
  • meta_jsonb.version_reference or equivalent baseline PolicyVersion linkage
• Validation:
  • baseline item must keep enough metadata to reconstruct evidence later
  • baseline snapshot item must not store tenant identifiers directly

RBAC Role Definition Compare Result

Tenant-scoped transient compare outcome created during baseline compare.

• Computed attributes:
  • policy_type = intuneRoleDefinition
  • role_definition_id
  • classification = unchanged | modified | missing | unexpected
  • severity = low | medium | high
  • built_in_state
  • diff_kind = metadata_only | permission_change | missing | unexpected
  • baseline_hash
  • current_hash
  • baseline_policy_version_id nullable
  • current_policy_version_id nullable

RBAC Drift Finding

Persistent tenant-owned finding generated through the existing baseline.compare pipeline.

• Existing model/table: Finding
• Relevant fields:
  • tenant_id
  • finding_type = drift
  • source = baseline.compare
  • scope_key = baseline_profile:{id}
  • fingerprint
  • recurrence_key
  • subject_type
  • subject_external_id
  • severity
  • status
  • times_seen
  • evidence_jsonb
  • current_operation_run_id
• Invariant:
  • unchanged identical drift does not create duplicate findings
  • resolved recurrence reopens through the existing lifecycle rules

Baseline Compare RBAC Summary

Run-level summary stored in compare run context.

• Existing container: OperationRun.context.baseline_compare
• New summary node:
  • rbac_role_definitions.total_compared
  • rbac_role_definitions.unchanged
  • rbac_role_definitions.modified
  • rbac_role_definitions.missing
  • rbac_role_definitions.unexpected
• Constraint:
  • keep rich counts in context; do not add non-canonical summary keys to summary_counts

Relationships

• A BaselineProfile belongs to one workspace and has one active scope definition.
• A BaselineProfile has many BaselineSnapshot records.
• A BaselineSnapshot has many BaselineSnapshotItem records, including intuneRoleDefinition items when selected.
• A Tenant has many InventoryItem rows and many PolicyVersion rows for intuneRoleDefinition.
• A Tenant has many baseline compare OperationRun rows and many Finding rows.
• A Role Definition compare result links one baseline snapshot item to zero or one current inventory row and zero or one current PolicyVersion.

Invariants

• intuneRoleDefinition is the only RBAC foundation type eligible for baseline compare in this release.
• intuneRoleAssignment must never appear in baseline capture, compare summaries, or findings.
• Role Definition identity is ID-based; same-name recreated objects with new IDs are drift.
• Compare uses normalized governance-relevant content, not raw transport payload shape.
• Metadata-only changes stay distinguishable from permission changes.
• Baseline evidence remains reconstructable without UI-time provider calls.
• Workspace-owned baseline artifacts must not persist tenant IDs.
• Tenant-owned compare runs and findings must remain workspace- and tenant-scoped.

State Transitions

Baseline support state

• unsupported
• supported and selectable in baseline profile

Role Definition compare classification

• unchanged
• modified
• missing
• unexpected

RBAC finding lifecycle

• new
• reopened
• resolved
• closed

Compare trust state

• full coverage proven
• partial coverage proven with suppression
• coverage unproven and findings suppressed

Validation Rules

• Baseline profile foundation selections must be a subset of explicitly baseline-supported foundation types.
• Baseline snapshot items for intuneRoleDefinition must carry stable identity and evidence-ready references.
• Role Definition compare must ignore transport-only noise and ordering differences in permission blocks.
• Severity mapping must follow the approved RBAC rule set.
• Assignment foundation type must fail closed for baseline-compare selection and result generation.