Source-derived document; reported behaviour, inference and evidence gaps are identified in the text.

Return to: Security boundaries

Security boundaries

Where do trust or privileges change, which flows cross those boundaries, and what controls are evidenced?

This view models the evidenced privilege boundary in the order-entry application: the operator is prompted for privileged status, the main menu exposes different capabilities, and privileged users receive a different order form that includes total price. E0009 The boundary is inferred from privilege-dependent control flow rather than from an identified authentication or authorization service. E0009 No assurance is made that the privilege decision is trustworthy or that the database enforces equivalent access controls. E0010

Only the crossing from the main menu to the order-form paths is shown. Database connectivity to stores7 is documented, but the supplied evidence does not establish a separate trust change or deployment boundary for that connection. E0009 Binary form files were not available for text analysis, so the model relies on the corresponding source form definitions and application source. E0009 E0010

Diagram

flowchart LR
  n12ec50a0e31f5cdd3964["Order operator"]
  n919a2ea77d9c63d92cdb["Main order menu"]
  nc4e30e906d27c767085a["Privilege presentation boundary (inferred)"]
  nfbd621e8dbba01cec182["Standard order form"]
  n103687ba5ab4bf62e561["Privileged order form"]
  n919a2ea77d9c63d92cdb -->|"Privileged order-form selection"| n103687ba5ab4bf62e561
  n919a2ea77d9c63d92cdb -->|"Standard order-form selection"| nfbd621e8dbba01cec182

Elements

Order operator

Kind: actor

Basis: reported

Description: The main program prompts the user for privileged status, sets priv to 1 when the response is y or Y, and leaves it at 0 otherwise. E0009

Evidence: E0009

Goal: Select and use the appropriate customer or order form.

Main order menu

Kind: component

Basis: reported

Description: The main program opens two bordered windows, selects p_ordcur for privileged users or ordcur for other users, displays the forms, and controls menu visibility according to priv. E0009

Evidence: E0009

Privilege presentation boundary

Kind: boundary

Basis: inferred

Description: The source establishes a privilege-dependent boundary between the nonprivileged and privileged menu and order-form paths. The evidence does not identify authenticated identity, a role provider, or an independently enforced authorization decision. E0009 E0010

Evidence: E0009, E0010

Standard order form

Kind: component

Basis: reported

Description: ordcur defines an order form containing order number, dates, customer number, instructions, backlog, purchase-order number, shipping data, and payment date. E0009

Evidence: E0009

Privileged order form

Kind: component

Basis: reported

Description: p_ordcur defines an order form with the order fields and a form-only monetary total-price field; privileged order browsing displays the aggregated t_price value alongside order fields. E0009

Evidence: E0009

Relationships

Privileged order-form selection

From: Main order menu

To: Privileged order form

Relation: crosses

Basis: reported

Description: The main program selects p_ordcur when the privilege flag is set, and privileged order browsing displays total price. E0009

Trigger: The operator's response to the privileged-status prompt.

Guard: priv is set to 1 when the response matches y or Y. E0009

Information: Privilege flag and order data, including aggregated total price. E0009

Mechanism: Conditional form selection and privilege-dependent order browsing. E0009

Trust change: The displayed order capability changes from the ordinary path to the privileged presentation path; the evidence does not establish a verified identity or stronger database authorization. E0009 E0010

Control: The prompt, conditional menu visibility, and selection of p_ordcur are evidenced controls. Their effectiveness as authorization controls is unverified because no authentication source, role validation, or independent enforcement is shown. E0009 E0010

Evidence type: Application-source control-flow finding.

Evidence: E0009, E0010

Standard order-form selection

From: Main order menu

To: Standard order form

Relation: crosses

Basis: reported

Description: The main program selects ordcur for users whose privilege flag is not set, and the nonprivileged order view omits the privileged t_price display. E0009

Trigger: The operator's response to the privileged-status prompt.

Guard: priv remains 0 when the response is not y or Y. E0009

Information: Ordinary order fields without the privileged total-price display. E0009

Mechanism: Conditional form selection and restricted menu exposure. E0009

Trust change: The operator remains on the nonprivileged presentation path; the evidence does not establish whether underlying order data or database operations are separately restricted. E0009 E0010

Control: The nonprivileged menu exposes only Query, Detail, Switch, and Exit, and the ordinary form omits t_price. These controls are evidenced in source, but their security adequacy is unverified. E0009 E0010

Evidence type: Application-source control-flow and form-definition finding.

Evidence: E0009, E0010

Gaps

The privilege prompt appears to accept a user-supplied y or Y value, but the evidence does not show authentication, identity binding, role lookup, tamper resistance, or server-side authorization. E0009 E0010

The evidence does not establish whether the privileged and nonprivileged paths differ only in presentation or also in permitted database operations. E0009 The stores7 connection is documented, but no supported crossing edge assigns the application to a host or proves a database-side privilege boundary. E0009

The binary ordcur.frm and p_ordcur.frm files were reported as unavailable for text analysis; their equivalence to the supplied .per definitions is unresolved. E0009 E0010 Follow-up should compare the compiled forms with the source definitions and inspect database authorization and transaction controls. E0010

Recovery limitations

• Ownership, mechanism or boundary controls remain explicitly unverified.
• Some identified concepts have no supported connection.
• The view includes explicitly marked inference.

Sources

• E0009 — SHA256 c4ffb94922eae3cda2f1c6d6b1215da47b424d41fea52db3870783bd43051b30
• E0010 — SHA256 bd29371182d16de63a7651533fa5c84e151a01ea9bf23399f7f6ca0397ab0250