TABLETOP / REPEATED ACCESS DENIALS

Trigger: an unusual increase in record_read events with status 403.
This is a signal to investigate, not proof of compromise.

Roles: incident lead _____; investigator _____; communications owner _____
1. Validate: check time range, baseline, affected identities, and request context.
2. Scope: is it one caller, a client regression, or a wider access pattern?
3. Contain: choose the narrowest justified intervention; record the decision.
4. Preserve: retain relevant evidence with controlled access. Never log tokens.
5. Recover: verify intended users retain access and checks still pass.
6. Learn: add one regression test or detection improvement with an owner.

Exercise inject: a client update causes repeated requests for stale record IDs.
What evidence distinguishes this from deliberate enumeration? __________
Who can approve containment? __________
How will you measure recovery? __________
Next improvement / owner / due date: __________