6b381e9517
- Entra admin roles scan job (ScanEntraAdminRolesJob) - Report service with fingerprint deduplication - Finding generator with high-privilege role catalog - Admin roles summary widget on tenant view page - Alert integration for entra.admin_roles findings - Graph contracts for roleDefinitions + roleAssignments - Entra permissions registry (config/entra_permissions.php) - StoredReport fingerprint migration - OperationCatalog label + duration for entra.admin_roles.scan - SummaryCountsNormalizer: filter zeros, humanize keys globally - 11 new test files (71+ tests, 286+ assertions) - Spec + tasks + checklist updates
61 lines
3.9 KiB
Markdown
61 lines
3.9 KiB
Markdown
# Specification Quality Checklist: Entra Admin Roles Evidence + Findings
|
|
|
|
**Purpose**: Validate specification completeness and quality before proceeding to implementation
|
|
**Created**: 2026-02-21
|
|
**Last Validated**: 2026-02-22 (post-analysis remediation)
|
|
**Feature**: [spec.md](../spec.md)
|
|
|
|
## Content Quality
|
|
|
|
- [x] No implementation details (languages, frameworks, APIs) in user stories
|
|
- [x] Focused on user value and business needs
|
|
- [x] Written for non-technical stakeholders (user stories section)
|
|
- [x] All mandatory sections completed (Scope Fields, User Scenarios, Requirements, Success Criteria, UI Action Matrix)
|
|
|
|
## Requirement Completeness
|
|
|
|
- [x] No [NEEDS CLARIFICATION] markers remain
|
|
- [x] Requirements are testable and unambiguous (21 FRs, each with MUST + verifiable condition)
|
|
- [x] Success criteria are measurable (SC-001 through SC-008 with quantitative metrics)
|
|
- [x] Success criteria are technology-agnostic (no framework/language references)
|
|
- [x] All acceptance scenarios are defined (6 user stories with 18 total acceptance scenarios)
|
|
- [x] Edge cases are identified (8 documented: partial data, service principals, group-assigned roles, scoped assignments, missing template_id, zero assignments, concurrent scans, threshold hardcode)
|
|
- [x] Scope is clearly bounded (Non-Goals section: no PIM, no remediation, no EvidenceItems, no RBAC refactor)
|
|
- [x] Dependencies and assumptions identified (Spec 104, Spec 099, Findings model, Graph RBAC API, no PIM, StoredReports retention)
|
|
|
|
## Feature Readiness
|
|
|
|
- [x] All functional requirements have clear acceptance criteria (FRs map to acceptance scenarios in user stories)
|
|
- [x] User scenarios cover primary flows (scan → report → findings → alerts → UI)
|
|
- [x] Feature meets measurable outcomes defined in Success Criteria
|
|
- [x] No implementation details leak into specification (entities section describes domain concepts, not code)
|
|
|
|
## Spec ↔ Plan ↔ Tasks Consistency (post-analysis)
|
|
|
|
- [x] No stale clarifications contradict plan/tasks (I1 remediated: migration Q&A corrected)
|
|
- [x] All 21 FRs have ≥1 implementation task (FR-021 is test-only; T035 confirms viewer rendering assumption first)
|
|
- [x] All success criteria are testable by ≥1 task (SC-005 now covered by T028(5); SC-006 backed by retention assumption; SC-008 deferred to staging)
|
|
- [x] Edge case: scoped assignments tested (T025(15) added)
|
|
- [x] Edge case: group = 1 principal tested (T025(11) covers principal types including group)
|
|
- [x] Posture score impact tested (T028(5) added)
|
|
- [x] Phase dependency D1 noted as advisory — US4 can start after Phase 2 (not blocked on Phase 4)
|
|
|
|
## Constitution Alignment
|
|
|
|
- [x] Constitution alignment (required) — Graph contracts, safety gates, tenant isolation, run observability, tests
|
|
- [x] Constitution alignment (RBAC-UX) — authorization planes, 404/403 semantics, capability registry, authorization tests
|
|
- [x] Constitution alignment (OPS-EX-AUTH-001) — N/A documented
|
|
- [x] Constitution alignment (BADGE-001) — new finding type badge documented with test (T014)
|
|
- [x] Constitution alignment (Filament Action Surfaces) — UI Action Matrix completed; widget exemption documented
|
|
- [x] Constitution alignment (UX-001) — Exemption for no new Create/Edit pages documented
|
|
|
|
## Notes
|
|
|
|
- All items pass. Spec + plan + tasks are consistent and ready for `/speckit.implement`.
|
|
- Plan.md and tasks.md have been written and validated against spec.
|
|
- High-Privilege Role Catalog includes Microsoft well-known template IDs for v1 classification.
|
|
- "Too many Global Admins" threshold is hardcoded at 5 with documented TODO for settings migration.
|
|
- SC-008 (scan performance ≤30s / 200 assignments) is not testable in standard Pest suite — validate on staging.
|
|
- FR-021 (report viewer) assumes existing viewer handles `entra.admin_roles` payload; T035 confirms this first.
|
|
- StoredReports retention (default 90 days) is assumed to be handled by existing infrastructure (documented in Assumptions).
|