AS IT STOOD 2026-08-22T04:14:05Z A record of what was known then. The live case has changed since, and it is linked rather than shown.Open the log

C-4417 · Larkfield Logistics Decided 2026-08-22T04:41:12Z · the live case has moved on since

What was decided, and by whom

Escalated, not ruled. Handed to S. Varga, SOC lead, by R. Idrissi through the provider’s on call tool. Clerk’s verdict, real, contain identity, stands unruled.

No reason code, and that is correct rather than missing. The reason taxonomy routes rejections to tuning. An escalation routes to a person, so what it carries is the handover below.

The handover, as it was written

What I checked. Correlated the token against the corporate range and confirmed the same correlationId on both sign ins.

What I could not do. Could not reach the client’s mail admin to confirm whether the forwarding rule is sanctioned.

What I need from you. A call to the client, and a decision on whether to disable the account before 08:00.

The evidence as it stood, 9 signals

A refresh token was presented from ASN 41xxx, first time for this tenantEntra sign in
The same token was used from the corporate range 4 minutes earlierEntra sign in
How this was readField correlationId matches across both sign ins, which is what makes it the same token rather than two. Read from the tenant’s own log, 04:08 to 04:12 UTC.
An inbox rule was created 90 seconds later, forwarding to an external addressExchange audit
not foundno password change, and no new device enrolmentEntra, EDR
points the other waythis user has travelled to this region twice in 90 daystenant baseline

What Clerk looked for and did not find is part of the record, and so is the one signal that argued the other way. An evidence trail that keeps only the supporting half is an argument, not a record.

6 sources queried over 24h as it stood.

Normal at this tenant, on that date

2 token replays at Larkfield Logistics in the 90 days to 2026-08-22, both real.

What Clerk was permitted to do here, on 2026-08-22

yesInvestigate
yesContain endpoint
noContain identitynot reversible without the client, so it asked
noContain networknot reversible without the client, so it asked
noRemove contentdestructive, so it always asks
noChange policydestructive, so it always asks

The record that stood behind the grant on that date: 34 of 36 accepted over the 30 days to 2026-08-22.

An auditor rarely asks whether this was the right call. They ask why the machine was allowed to do that, and a settings page cannot answer it: it shows the grant now, and the grant may have been widened twice since. 3.5 shows the present. This shows the past, and only one of the two is evidence.

This snapshot stays retrievable until 2026-11-20T04:14:05Z, from your provider’s contract. The verdict above is kept for the life of the record. You learn the window here rather than from a failure.

The address of this record

/log/e-88214?as-of=2026-08-22T04:14:05ZCopy the address

The address is the artefact. Without ?as-of it resolves to this entry’s own decision time, and the product writes the parameter into every link it generates so a copied address never depends on a default.

Where the case is now

The live case has moved on since this snapshot. S. Varga ruled on it at 2026-08-22T05:58:20Z, one hour and seventeen minutes after this record was written.

What changed is not listed here. The live case is named and linked rather than shown beside this one. Current values next to historical ones is the confusion, not the cure.

Open C-4417 as it is nowOpen this entry in the log

There are no verdict controls on this page, at any width. You cannot rule on the past, and an Accept here would be a second decision wearing the first one’s date.

End of the record as it stood 2026-08-22T04:14:05Z. Nothing below this line, and nothing on this page, can be edited.