THE QUESTION: Same control, two pieces of evidence: did every production access grant get an approval this year? One of these files tells you much less than it appears to.
[A] audit/CC6.1-sampling.md 1 │ population: 24,000 access grants (all prod, 12 mo) 2 │ sample: 25 grants, random, reproducible 3 │ tester: external, independent 4 │ exceptions: 0 of 25 5 │ conclusion: control operated effectively across the population 6 │ basis: no exceptions in tested sample
[B] queries/unapproved-grants.sql 1 │ SELECT g.grant_id, g.grantee, g.granted_at 2 │ FROM prod_access_grants g 3 │ LEFT JOIN approvals a ON a.grant_id = g.grant_id 4 │ WHERE g.granted_at >= '2026-01-01' 5 │ AND a.approved_by IS NULL; 6 │ -- 14 rows returned · tickets opened: ACC-3401..3414
grc@ctrl-f:~$