This view contains identified evidence gaps.

Security boundaries

Where do trust or privileges change, which flows cross those boundaries, and what controls are evidenced?

This view separates identity acceptance, request execution authority, and resource or account privileges. The published evidence describes OAuth sign-in, bearer validation, token forwarding, dynamic mediator dispatch, notification-access changes, and user-role changes; it does not demonstrate their complete combined runtime enforcement. E0368 E0011 E0105 E0358 E0460 E0114

Read each crossing as a documented flow that encounters a trust or privilege decision—not as proof that access is granted. The two boundary elements are inferred logical boundaries, not established network or deployment boundaries. Middleware registration and authorization attributes evidence configured or declared controls; their effective coverage remains unverified where implementations or callers are missing. E0011 E0257 E0001

The model deliberately distinguishes authentication from permission to act on a particular notification or account. The documents report authenticated entry points that accept client-selected targets, while leaving downstream ownership, role, and current-state checks unresolved. Missing documentation establishes neither a vulnerability nor adequate security. E0105 E0358 E0460

Diagram

flowchart LR
  n54814cd12a61aa30df23["Browser or API caller"]
  ndec2faa0e3f748d8b538["MVC web"]
  ndf2d94720f26deb8db24["ApiMediator"]
  ne9b5cd2acc1cad690e67["IWS API"]
  na8a58a45c0ac7dd5ea0c["Request handlers"]
  na3bae3b59d746d5dc25d["Notification access #40;inferred#41;"]
  ne7aab5df86b1c77778c9["User accounts and roles #40;inferred#41;"]
  n54814cd12a61aa30df23 -->|"OAuth sign-in"| ndec2faa0e3f748d8b538
  n54814cd12a61aa30df23 -->|"Bearer identity acceptance"| ne9b5cd2acc1cad690e67
  ndf2d94720f26deb8db24 -->|"User-to-service credential delegation"| ne9b5cd2acc1cad690e67
  ne9b5cd2acc1cad690e67 -->|"Dynamic request dispatch"| na8a58a45c0ac7dd5ea0c
  ndec2faa0e3f748d8b538 -->|"Client-selected notification deletion"| na3bae3b59d746d5dc25d
  ndec2faa0e3f748d8b538 -->|"Shared-access change"| na3bae3b59d746d5dc25d
  ne9b5cd2acc1cad690e67 -->|"Internal-account creation"| ne7aab5df86b1c77778c9
  ne9b5cd2acc1cad690e67 -->|"Account-targeted profile update"| ne7aab5df86b1c77778c9
  na8a58a45c0ac7dd5ea0c -->|"Approval-driven role assignment"| ne7aab5df86b1c77778c9

Elements

Browser or API caller

Kind: actor
Basis: reported
Description: Supplies login inputs, HTTP requests, and selected request data to MVC or API entry points. API inputs include a mediator request type name and account identifiers. E0368 E0358
Evidence: E0368 E0358

MVC web

Kind: component
Basis: reported
Description: Contains OAuth login orchestration, notification deletion, and notification-sharing controllers. Authentication, activity authorization, and ownership hooks are visible on selected paths, but their combined enforcement is not established. E0368 E0105 E0017
Evidence: E0368 E0105 E0017

ApiMediator

Kind: component
Basis: reported
Description: Forwards requests to the IWS client with a user token where available, otherwise obtaining a client-credentials token. Its ordinary-request rejection condition differs from the path marked as allowing unauthorized users. E0105
Evidence: E0105

IWS API

Kind: component
Basis: reported
Description: An OWIN-composed Web API application with IdentityServer middleware, bearer validation, claims transformation, and mediator dispatch. Registration-controller actions also create or update user accounts. E0011 E0358
Evidence: E0011 E0358

Request handlers

Kind: component
Basis: reported
Description: Registered mediator handlers execute selected notification, sharing, ownership, and user-administration operations. Authorization and notification-read-only decorators are registered around handlers, but their implementations are not supplied. E0257 E0460 E0114
Evidence: E0257 E0460 E0114

Notification access

Kind: boundary
Basis: inferred
Description: A logical boundary between submitted notification selections or access-change requests and server-authorized notification operations. Deletion, sharing, and ownership handlers expose this distinction, without establishing complete mutation authorization. E0105 E0017 E0460
Evidence: E0105 E0017 E0460

User accounts and roles

Kind: boundary
Basis: inferred
Description: A logical boundary around account-target selection and changes to internal status or role claims. The API registration controller and user-administration handlers provide concrete account and privilege-changing paths. E0358 E0114
Evidence: E0358 E0114

Relationships

OAuth sign-in

From: Browser or API caller
To: MVC web
Relation: crosses
Basis: reported
Description: The login flow obtains an OAuth access token, creates an identity, signs in, and selects a destination using role claims and a local-return-address check. E0368
Trust change: Login inputs and a token response become a signed-in application identity; internal and readonly claims affect navigation, not a proven complete permission policy. E0368
Control: A local-return-address check and anti-forgery attributes are evidenced. Cookie security settings, claim validation, and complete authentication enforcement are unverified. E0368
Evidence: E0368

Bearer identity acceptance

From: Browser or API caller
To: IWS API
Relation: crosses
Basis: reported
Description: Incoming API requests encounter configured bearer validation and claims transformation before Web API dispatch. E0011
Trust change: An incoming bearer identity is processed into server-side claims and user context. User-context selection considers the first identity and can ignore later identities; claims transformation passes a looked-up user onward without a visible missing-user check. E0358
Control: Validation uses a configured authority, validation-endpoint mode, and scope values api1 and api3. Whether both scopes or alternatives are required, and endpoint-wide enforcement, are unverified. E0011
Evidence: E0011 E0358

User-to-service credential delegation

From: ApiMediator
To: IWS API
Relation: crosses
Basis: reported
Description: ApiMediator sends requests through the IWS client using the HTTP user's token or a client-credentials fallback. E0105
Trust change: A web-originated operation may be represented downstream by a user credential or a service credential; their effective downstream privileges are not established. E0105
Control: Ordinary requests are rejected when the token is blank and the HTTP user is unauthenticated. Requests marked as allowing unauthorized users omit that explicit rejection. Blank-token handling and service-token restrictions are unverified. E0105
Evidence: E0105

Dynamic request dispatch

From: IWS API
To: Request handlers
Relation: crosses
Basis: reported
Description: MediatorController resolves a client-supplied type name, deserializes the resolved type, derives a response type from its first interface, and sends the request to the mediator. E0358
Trust change: Caller-selected type information becomes a server-side request object submitted for execution. Which operations are reachable through this selection remains unresolved. E0358
Control: Request-authorization and read-only decorators are registered, and request contracts declare permissions. Their enforcement semantics are unverified; the controller evidence shows no request-type allowlist or expected-interface validation. E0257 E0001 E0358
Evidence: E0358 E0257 E0001

Client-selected notification deletion

From: MVC web
To: Notification access
Relation: crosses
Basis: reported
Description: The deletion controller looks up details using a notification number and subsequently sends a deletion request using the posted notification identifier. E0105
Trust change: Client-selected notification identity determines the target submitted for a destructive operation. Correspondence with the earlier lookup, operator access, and current deletability are not established in the controller. E0105
Control: An activity-authorization attribute is evidenced. Notification-specific ownership and POST-time state revalidation are unverified. The lookup path can dereference a null result rather than return a controlled not-found outcome. E0105
Evidence: E0105

Shared-access change

From: MVC web
To: Notification access
Relation: crosses
Basis: reported
Description: The sharing flow validates selected users, stages them in TempData, and sends an AddSharedUser request on confirmation. The corresponding handler applies additions and saves. E0017 E0460
Trust change: Selected users become subjects of a notification-access change; the resulting permissions must not be equated with system-wide administrator privileges. E0460
Control: Activity-authorization and notification-owner filters are visible, together with self-sharing, external-user, and already-shared checks. Filter semantics, confirmation-state integrity, final duplicate handling, and mutation authorization are unverified. E0017 E0460
Evidence: E0017 E0460

Internal-account creation

From: IWS API
To: User accounts and roles
Relation: crosses
Basis: reported
Description: RegisterAdmin creates a user with an Internal role claim. Its controller has class-level authorization but no visible administrator-role restriction on that method. E0358
Trust change: An account-creation request produces an internal-role identity, crossing a privilege-assignment boundary. The effective privileges of the new account and caller eligibility remain unresolved. E0358
Control: Class-level authentication authorization is evidenced. Administrator-only or equivalent global restrictions are unverified; the source-level omission is not proof of a reachable privilege escalation. E0358
Evidence: E0358

Account-targeted profile update

From: IWS API
To: User accounts and roles
Relation: crosses
Basis: reported
Description: UpdateApplicantDetails selects the account from the submitted model identifier and updates profile information, including email and username. E0358
Trust change: A caller-selected account becomes the mutation target, rather than a target visibly derived from the current subject. E0358
Control: Class-level authorization is visible, but comparison with the current user and administrator-only access are unverified. Email-confirmation reset or re-verification is not visible; implicit user-store behavior remains unresolved. E0358
Evidence: E0358

Approval-driven role assignment

From: Request handlers
To: User accounts and roles
Relation: crosses
Basis: reported
Description: The approval handler requires an existing approved requester. Approval can add an Administrator claim or replace an Internal claim with ReadOnly; it assumes Internal claims already exist in another branch. E0114
Trust change: Approval decisions alter account status and selected role claims. Rejection changes domain status without visibly removing role claims in this handler. E0114
Control: The handler's approved-requester check and an administrator-only permission mapping are evidenced. Enforcement of that mapping before invocation is unverified; approved status alone is not an administrator-role check. Returned identity-operation results are not visibly inspected. E0114
Evidence: E0114

Gaps

• Effective authorization chain: Obtain decorator implementations, permission registration, request-attribute caching, controller filters, and endpoint-to-handler tests. The web authorization service allows request types without cached attributes, while the role decision component denies unknown activities; these are different decision points, not evidence of one uniform default. Action-name bypasses are also reported without controller or area scoping. E0105 E0114 E0257

• Identity and credential semantics: Resolve scope interpretation, deployed authority configuration, multiple-identity ordering, stale-subject handling, and service-token permissions. The supplied documents do not establish these controls end to end. E0011 E0358 E0105

• Resource binding and privilege changes: Inspect deletion, sharing, ownership, profile-update, and internal-registration policies using mismatched, stale, and cross-user targets. Handler calls and visible attributes do not establish that every target is independently authorized. E0105 E0017 E0460 E0358

• Scanning boundary: The chapters report an authorized scanner POST and an anonymous health-style GET, but the underlying scanner artifact they reference is not supplied here. Keep this as chapter-reported behavior rather than underlying-evidence verification; obtain scanner middleware, implementations, upload limits, and result-handling evidence before expanding the model. C02 C10

• Operational boundaries: Plaintext secrets, permissive Elmah settings, large request limits, and explicit TLS protocol configuration are reported, but active credential status, deployed transforms, infrastructure restrictions, and actual error-log exposure remain unresolved. No operational assurance follows from these configuration observations. E0011

• Evidence limits: These are published retained analyses of bounded source extracts, not live inspection or successful end-to-end test execution. Some summaries also conflict with their own coverage inventories; follow-up should reconcile the underlying artifacts rather than treating omission lists as proof that controls do not exist. E0105 E0017 E0257

Recovery limitations

• Ownership, mechanism or boundary controls remain explicitly unverified.
• The view includes explicitly marked inference.

Sources

• C02 — SHA256 5f0242dead31d39b1254a75032bb6e91eb76df06330b351c7542819e8ed170b4
• C10 — SHA256 6ca1acb64b4f356fc274bdf340f0ce48a5f37133e0b9d2da632a9ba794dc90c0
• E0001 — SHA256 f7507935020faae5f57de8c0a09fde4497ef4576fb1421ef8f5b33897cec0cad
• E0011 — SHA256 08fada41c905cfd05613f4ccc1ac81e12e057e2de1976cf7788a4cabf6df2ca8
• E0017 — SHA256 d085853b1955cb12eb4ab9e6d7193b1ecca10fb74c074a1b98277f70d3bc8e36
• E0105 — SHA256 12b62da8b7e9a99fadf1119260cb9fac7f4c9573127847ceed2eda7b4fd93cbb
• E0114 — SHA256 ae0669804c1d8096512afaa821d73ed20bc46e28028990938c706c2117ddea25
• E0257 — SHA256 7ca588f6a8f2bdeba7adb41997832e995bca5d93f99db31c223250e62e5693f3
• E0358 — SHA256 791018202483cb994d2d16c34183968f9e9a7f8d148100c4db3ec22568619d15
• E0368 — SHA256 63f02c88663a7a507fb44d2f439d03c837c9de9f60fd5c4387dee54a3e1dedbb
• E0460 — SHA256 ff23c6146b961faa18e1bdb243029d89bf8a5afd875509bc97c6cfc077e3cb7e