Network Access Auditor
Explain effective access risks, shadowed rules and expired MAB exceptions in a declared NAC policy model.
- My role
- Design & implementation
- Scope
- Offline NAC policy review
- Release
- v0.1.0
Validation scope
Explainable authorization review
124 tests and eight CLI scenarios. CI on Python 3.11–3.13. Synthetic reference: 30 modeled states and nine report files per accepted input.
Inside the work
How it works
Normalize policy intent
Declare groups, trust, profiles, ordered rules and an assessment date in JSON. Add endpoint observations, MAB exceptions and expected profiles.
Evaluate every modeled state
Enumerate group, method and posture combinations. Record the first enabled match or default, plus effective and shadowed rule coverage.
Explain review findings
Link effective access risks to winning rules and witness states. Check dated MAB exceptions and exact expected-profile mismatches.
Package a reproducible review
Write nine JSON, CSV and Markdown artifacts with hashes. A severity gate controls exit status while preserving every finding.
Decisions & trade-offs
Effective outcomes firstAnalyze the rule that actually wins
Analyze the rule that actually wins
Earlier rules can jointly shadow a later rule. A fully shadowed broad permit is reported as shadowed, not as effective exposure.
The trade-off
Coverage is exhaustive only inside the declared dimensions: 30 states in the reference, at most 198. These are not observed sessions.
Dated exception accountabilityUse an explicit assessment date
Use an explicit assessment date
Check an owner and inclusive expiry date for MAB exceptions attached to declared observations. Same-day expiry remains current.
The trade-off
A current exception never waives baseline controls. The tool identifies expired records; it does not revoke access.
Separate findings from gatingKeep the evidence when a gate passes
Keep the evidence when a gate passes
The configured severity threshold controls the exit code, not which findings remain in the report. Exact profile IDs support intent checks.
The trade-off
A passed gate or no findings cannot establish network security. Group trust and profile access tiers remain reviewer declarations.
Technologies by purpose
Python
Offline CLI; Python 3.11+ with no runtime dependencies.
Normalized NAC model
JSON groups, profiles, ordered rules, observations and baseline.
First-match analysis
Complete declared-state coverage and deterministic witnesses.
CSV & Markdown
Readable findings, rule coverage, exceptions and intent checks.
SHA-256 & CI
Unsigned file hashes and eight reproducible CLI scenarios.
Scope & evidence
Published evidence
- Release & report packages
Three complete reviews in one ZIP; no installation.
- Verification record
124 tests, eight CLI scenarios and observed results.
- CI test matrix
Successful Python 3.11, 3.12 and 3.13 jobs.
- ISE normalization boundaries
Manual mapping, vendor references and exclusions.
- Engineering decisions
Coverage, witnesses, expiry and report integrity.
Validation limits
- Offline review of a manually normalized model. No native ISE import, live connection, complete ISE emulation, authentication or enforcement validation.
- Trust, access tiers and endpoint observations are supplied. Findings may overlap; counts are not unique real endpoints or confirmed attacks.
- Current exceptions do not waive the baseline. No findings is not security certification; manifests and release checksums are unsigned.
Test captures
Recorded evidence · synthetic offline models, not a product interface.
Enlarge Trace risk to its winning rule
30 modeled states; 15 overlapping findings. A witness explains the winning rule. Synthetic evidence.
Source · 2026-10-29
Enlarge An exception expires; access remains
Expiry is inclusive. Current exceptions do not waive the explicit baseline or change modeled access.
Source · 2026-10-29