Live workspace. Durable storage schema active — live connectors, billing, and AI automation are activation-gated.View Activation Status
Signed out
Sign in as the approved QA user before running RLS-bound QA.
Sign in
Advanced / Operator Controls → Live-Read Preactivation

Live-Read Preactivation

READINESS PACK ONLY
Preview only. No Microsoft connection. No OAuth. No live read. No write.

About this page

This is an advanced safety checkpoint. It verifies that we have strict rules in place before ZAGOS is allowed to read any real data from your providers.

What you can do safely

  • Review the zero-write guarantees
  • Check the approved data scopes
  • Understand the rollback criteria

What is currently blocked

  • Actual execution of a canary test
  • Calling any provider APIs

Recommended Next Step

Proceed to review the canary rehearsal simulation.

Proceed to Canary Rehearsal →
Technical Details & Execution Matrix
Candidate Providers

Microsoft 365 / Entra ID

Recommended First Canary

Highest concentration of SOC 2 identity and access management controls. Ideal first canary candidate due to robust read-only graph API scoping.

PARKED GATE

Google Workspace

Alternative Candidate

Secondary identity provider. More fragmented admin API scope granularity makes it a slightly higher risk for first canary than Microsoft.

PARKED GATE

GitHub

Alternative Candidate

Essential for SDLC and change management controls, but lower impact on enterprise-wide identity. Good second canary candidate.

PARKED GATE
Zero-Write Readiness Contract
LIVE ACTION BLOCKED
  • No HTTP POST, PUT, PATCH, or DELETE requests will be made to any provider API.
  • Only HTTP GET requests or strictly read-only GraphQL queries will be executed.
  • Database transactions will only persist simulated evidence logs in isolated schema partitions.
  • No production database records outside the designated simulated evidence tables will be mutated.
  • No execution paths exist that can trigger provider-side state changes (e.g., password resets, policy updates, role assignments).
Scope Approval Matrix
Required scopes and data boundaries for candidates.

MICROSOFT 365

Required Scopes
  • User.Read.All
  • Directory.Read.All
  • Policy.Read.All
  • DeviceManagementConfiguration.Read.All
Allowed Data
  • User metadata (name, email, role, status)
  • Group memberships
  • Security policies and configurations
  • Device compliance status
Prohibited Data
  • Email contents (Mail.Read)
  • File contents (Files.Read)
  • Chat messages (Chat.Read)
  • Passwords or credentials

GOOGLE WORKSPACE

Required Scopes
  • admin.directory.user.readonly
  • admin.directory.group.readonly
  • admin.reports.audit.readonly
Allowed Data
  • User profiles and statuses
  • Group metadata
  • Audit logs for login and admin actions
Prohibited Data
  • Drive files
  • Gmail contents
  • Calendar events
  • Chat messages

GITHUB

Required Scopes
  • read:org
  • repo:status
  • read:user
Allowed Data
  • Organization members and roles
  • Repository protection rule configurations
  • Commit statuses and PR metadata
Prohibited Data
  • Source code contents
  • Secrets or tokens
  • Issue or discussion text content
Abort & Rollback Criteria
Conditions under which any future live-read canary must immediately halt.
OWNER ACTION REQUIRED
  • API request timeout exceeds 5000ms.
  • Provider returns HTTP 403 Forbidden or 401 Unauthorized, indicating scope mismatch.
  • Response payload exceeds 10MB, risking memory exhaustion or data over-collection.
  • Unexpected data classes (e.g., file contents, PII bodies) are detected in the response payload during schema validation.
  • Rate limit threshold (HTTP 429) is hit; execution must halt immediately without aggressive retries.
  • Owner clicks "Abort Execution" in the Next Action Control Center.
Rollback Plan: Halt execution, securely drop any in-memory data, log the abort reason, and revert the gate state back to PARKED GATE.