SLO and Error Budget Service  ·  View 20 of 21  ·  Assurance

Identity and Privilege Flow

Excluding forty minutes — and the one message that is refused.

Editable source SVG draw.io All views
SLO author Reliability lead Entra ID Privileged API SLO registry Audit ledger Key Vault HSM 1. sign in + MFA 2. claims: author 3. exclude 22:10–22:48 4. reason code present? 5. author cannot approve 6. sign in + MFA 7. approve, expiry 30 d 8. > 60 min? second approver 9. actor, reason, prior value 10. annotate, never delete 11. both figures retrievable 12. re-sign current verdict 13. signature, valid 5 min 14. applied, counted in register Identity and Privilege — Excluding Forty Minutes The refused message is the design. The person who wrote the SLO cannot approve the removal of a minute from it, because an exclusion privilege in the hands of the measured party is not a control. Everything afterwards is recorded before it is applied. v 1.0 · owner Reliability Architecture · date 2026-10

Decisions

  • The refused message is the design. The person who authored the SLO cannot approve the removal of a minute from it: an exclusion privilege in the hands of the measured party is not a control (ADR-11).
  • The audit write happens before the registry write. An exclusion is recorded before it is applied, so a failure between the two leaves evidence rather than a silent change (ADR-14).
  • Both figures stay retrievable after the annotation. The platform never loses the ability to answer what the month looked like before anyone intervened.

Assumptions

  • MFA on every privileged action, with claims carrying the four grants from the corporate identity provider — assumed.
  • Exclusions expire by default at 30 days; a permanent exclusion is not expressible — assumed.
  • Verdict signatures are valid for 5 minutes, which bounds replay without making every read a signing call.

Risks

  • Separation of duties is only as strong as role hygiene. A reliability lead who also authors SLOs for their own service re-creates the conflict the refusal was designed to prevent.
  • Re-signing the current verdict after an annotation means a gate holding a cached verdict may enforce a pre-exclusion answer for up to the staleness ceiling.
◀  Security Trust Zones All views Failure Classes and Their Answers  ▶
Solution Architecture v1.0 · Microsoft Azure · Reliability Architecture · 2026-10 · 21 views · 17 architecture decision records20-privilege-and-signing-flow