Authorization recovery evidence
Use this evidence alongside your own recovery rehearsal. Passing these controlled fixtures establishes the tested assignment and access outcomes; it does not certify every combination of identity provider, target-only permissions or application policy.
The machine-readable evidence bundle records exact source hashes, image digests, client versions, counts, access-probe outcomes and cleanup proof. Native qualification and public-artifact verification are separate stages. The bundle records each stage's status explicitly.
Published artifact verification
Enterprise 0.8.0 is published. The public Linux amd64 image was pulled anonymously into an empty Docker configuration and pinned by digest. Full recovery was repeated against that exact image on Platform 7.6.0 and a fresh two-environment Cloud fixture: data and schemas restored, source unavailable, interrupted apply resumed, independent allowed/denied access probes passed, and second apply created zero assignments. All five public binary archives passed checksum checks, and the public Helm chart passed a real Kind installation.
The bundle includes the released commit, executable/image hashes, trial lifecycle checks, commercial signer cutover, chart provenance and postpublication recovery results. The container currently supports Linux amd64; standalone ARM binaries are also available.
Tested native recovery
| Fixture | Captured assignments | Resume after committed DENY | Repeat apply |
|---|---|---|---|
| Confluent Platform 7.6.0 | 11 roles and 10 ACLs | 20 created; one reconciled existing assignment | Zero creates |
| Confluent Platform 8.3.1 | 11 roles and 10 ACLs | 20 created; one reconciled existing assignment | Zero creates |
| Confluent Cloud, two environments in OSO | Eight IAM roles and eight ACLs | 15 created; one reconciled existing assignment | Zero creates |
Each fixture restored actual Kafka records and schemas before releasing application permissions. Platform source Kafka, Schema Registry, Connect and ksqlDB services were stopped before apply. The Cloud scenario deleted the source cluster and environment before apply. Changing a config file alone was not treated as a source-outage test.
An independent client observed a committed DENY while its journal intent remained incomplete. The apply process was then killed. Resume reconciled that assignment and created the remaining assignments; an interrupted process did not leave a successful recovery report.
Independent access checks
Java Kafka clients and direct component clients tested Platform authorization. Cloud used independent REST clients and confluent-kafka 2.6.1. Probes covered permitted and prohibited produce, consume, group and transactional operations, administrator assignments, host restrictions, wildcard resources and literal/prefixed rules. Secured Schema Registry, Connect and ksqlDB checks exercised Platform component roles. Cloud checked service accounts, administrative scopes, subject roles, real IAM pagination and propagation.
Target-only sentinel assignments remained. Independent inventories compared exact role and ACL tuples and checked that writes stayed within the selected fixture scopes. Assignment verification found no missing selected assignments.
Cleanup and boundaries
Both native Platform Compose projects were removed, including their containers, networks and volumes. Cloud teardown independently proved 38 recorded resources absent and an empty Terraform resource inventory. A 403 response was not accepted as deletion proof. No organisation was created; the fixture used the existing OSO organisation and two Standard Azure West Europe clusters in separate environments.
Cloud qualification covers User:sa-… service accounts within one organisation. Cloud user/group/identity-pool and wildcard principal recovery, cross-organisation recovery, operator integration, application freezing and complete cross-component recovery sets are excluded. Kafka ACL writes require SASL/PLAIN over SASL_SSL or SASL_PLAINTEXT.
After the public-image run, a fresh independent inventory again confirmed all 38 fixture resources absent and no fixture role bindings. The temporary bootstrap key was then revoked; a refreshed authenticated browser inventory showed zero API keys. Credential-bearing fixture files, Terraform state and local secrets were removed. Historical native reports retain the bootstrap-pending value from their capture time; the bundle’s final cleanup record supersedes it.
Follow the recovery rehearsal and evaluation guide. Record your own positive and negative access outcomes, preserve durable journals, then delete only your fixture's resources and revoke its credentials.