{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp12_substrate_denial72_20260805","research_id":"eoa_inverse_innovation_exp12_light_screen_20260805","cell_id":"modular_decomposition__computer_science","search_lanes":{"direct_problem_and_intervention":{"queries":["legacy application duplicated authorization logic HTTP handlers background workers query builders audit shadow decisions normalized authorization request decision","scattered authorization checks duplicated policy logic multiple application execution paths"],"source_ids":["SRC1","SRC2"],"no_result_note":null},"synonyms_and_historical_terms":{"queries":["reference monitor authorization context handler policy decision point policy enforcement point request response","XACML PDP PEP obligations request context centralized authorization routine"],"source_ids":["SRC1","SRC2"],"no_result_note":null},"products_practices_and_standards":{"queries":["Open Policy Agent decision logs policy revision input result authorization audit replay","authorization policy LOG_ONLY shadow mode compare decisions without enforcement","XACML 3.0 core specification authorization request response obligations"],"source_ids":["SRC2","SRC3","SRC4"],"no_result_note":null},"component_combination":{"queries":["embedded policy decision point structured authorization request obligations audit decision replay shadow mode","authorization decision replay conformance testing multiple enforcement points background jobs","centralized authorization routine multiple access paths policy decision logging shadow evaluation"],"source_ids":["SRC1","SRC2","SRC3","SRC4"],"no_result_note":null}},"sources":[{"source_id":"SRC1","title":"C1: Implement Access Control","publisher":"OWASP Foundation","url":"https://top10proactive.owasp.org/the-top-10/c1-accesscontrol/","source_type":"OFFICIAL_GUIDANCE","claims_supported":["Applications can expose the same operation through multiple access paths and all paths must use aligned access-control checks.","Multiple authorization implementations create a weakest-copy risk, while a consolidated routine is easier to review and fix.","Large codebases containing many access-control checks are difficult to audit or verify, including in multi-tenant applications."]},{"source_id":"SRC2","title":"eXtensible Access Control Markup Language (XACML) Version 3.0","publisher":"OASIS Open","url":"https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-cos01-en.html","source_type":"OFFICIAL_STANDARD","claims_supported":["XACML already separates policy enforcement from policy decision evaluation through PEP and PDP responsibilities.","The standard defines authorization request and response contexts and decisions including Permit, Deny, Indeterminate, and NotApplicable.","Decision responses can carry obligations and advice for interpretation or fulfillment by enforcement points.","Missing required context attributes have defined decision and refinement behavior."]},{"source_id":"SRC3","title":"Decision Logs","publisher":"Open Policy Agent","url":"https://www.openpolicyagent.org/docs/management-decision-logs","source_type":"FIRST_PARTY_PRODUCT","claims_supported":["OPA decision events record policy input, result, policy-bundle revision, decision identifiers, timestamps, and trace information for auditing and offline debugging.","Decision-log data supports debugging and decision replay, including capture of nondeterministic inputs.","Authorization inputs and results may contain sensitive data, and OPA provides field erasure and masking controls."]},{"source_id":"SRC4","title":"Test a policy in LOG_ONLY mode","publisher":"Amazon Web Services","url":"https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-test-a-policy.html","source_type":"FIRST_PARTY_PRODUCT","claims_supported":["LOG_ONLY mode evaluates policies and records results without permitting, denying, blocking, or modifying actions.","Shadow evaluation can be used to observe policy behavior before promotion to active enforcement.","Engine-level and policy-level enforcement modes make non-enforcing evaluation an explicit operational state."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The general problem class is visible: OWASP explicitly identifies multiple access paths, inconsistent access-control implementations, weakest-copy exposure, and audit difficulty in large or multi-tenant codebases. The retained sources do not establish that the proposed legacy SaaS instance actually contains divergent HTTP, queued-job, scheduled-job, query, and audit copies, so that instance-level premise still requires the proposed dependency map and replay.","source_ids":["SRC1"]},"closest_prior_art":[{"name":"OWASP consolidated access-control routine","source_ids":["SRC1"],"overlap":"Calls for every access path to use aligned checks and recommends one reusable authorization procedure rather than multiple potentially inconsistent implementations.","remaining_difference":"It does not specify capability-level in-process modules, channel context adapters, a versioned decision-and-obligation record, shadow comparison, stewardship, or mutation-locality measurement across synchronous and asynchronous paths."},{"name":"XACML PEP/PDP/context architecture","source_ids":["SRC2"],"overlap":"Already separates context acquisition, policy decision evaluation, and enforcement behind a standardized authorization request-response model whose results can carry obligations.","remaining_difference":"It is a general architecture and policy standard, not a single-rule refactoring protocol for one legacy deployable; it does not prescribe the proposed three-channel shadow replay, named module stewardship, or the test-only semantic-mutation locality criterion."},{"name":"Decision logging plus non-enforcing shadow policy evaluation","source_ids":["SRC3","SRC4"],"overlap":"Existing products record structured policy inputs, outcomes, policy revisions, and trace data, support replay-oriented debugging, and evaluate policies in a log-only mode that cannot affect enforcement.","remaining_difference":"These product practices do not by themselves decompose duplicated legacy authorization code into capability policy, context, enforcement, and evidence packages or prove that a rule change remains local while HTTP, queued, and scheduled paths agree."}],"prior_art_disposition":"SUBSTANTIAL_COLLISION","contrastive_claim_remaining":"The remaining falsifiable claim is narrower than centralized authorization, standardized request-decision contracts, decision logging, or shadow evaluation individually: for one legacy export rule and without a network service or universal gateway choke point, responsibility-aligned in-process modules and three channel adapters will let a no-new-information semantic mutation change only the export-policy module and fixtures while HTTP, queued-worker, and scheduled-job replays preserve the policy-owner-adjudicated decision, reason, policy version, and audit obligations.","contrastive_claim_falsifier":"The contrastive claim is falsified if a policy-only mutation with no new context requirement still forces changes to any channel adapter or shared contract; if any direct rule implementation remains reachable outside the policy module; or if equivalent adjudicated cases produce differing decisions, reasons, or required audit obligations across the three paths.","gates":{"adequate_source_search":{"status":"PASS","rationale":"The bounded search covered the proposal directly, older PDP/PEP and reference-monitor terminology, an official access-control standard, established guidance, first-party policy logging, shadow-operation practices, and combinations of those components. Exactly four opened sources from four publishers were retained.","source_ids":["SRC1","SRC2","SRC3","SRC4"]},"supported_problem":{"status":"PASS","rationale":"The general multiple-path inconsistency and auditability problem is directly supported, although its occurrence in the proposed application remains unverified; therefore problem evidence is appropriately PARTLY_SUPPORTED.","source_ids":["SRC1"]},"distinct_testable_claim":{"status":"PASS","rationale":"Despite substantial overlap with established authorization architecture and shadow tooling, the residual claim has observable boundaries: one rule, three paths, a no-new-information mutation, enumerated allowed change locations, and adjudicated decision and evidence invariants.","source_ids":["SRC1","SRC2","SRC3","SRC4"]},"bounded_next_test":{"status":"PASS","rationale":"The proposed isolated-branch pilot is bounded to one rule, three adapters, 24 synthetic cases, one semantic mutation, and explicit continue-or-redraw criteria. Structured decision evidence and non-enforcing evaluation are established supporting practices.","source_ids":["SRC3","SRC4"]},"no_obvious_safety_or_authority_stop":{"status":"PASS","rationale":"The first step is nonproduction, shadow-only, uses synthetic or approved redacted cases, leaves existing enforcement authoritative, and assigns rule meaning and deployment approval to the appropriate owners. Sensitive decision inputs remain a real logging hazard, but explicit fixture restrictions and masking make it a controllable condition rather than an obvious stop.","source_ids":["SRC3","SRC4"]}},"screen_survival":false,"world_novelty_boundary":"This bounded public-web screen found substantial collision with established authorization separation, request-decision contracts, obligation-bearing results, decision logs, and shadow evaluation. It cannot establish world novelty, patentability, market size, expert acceptance, or realized value."}