Skip to content

Verify & confirm

Verification is completed by automated in-product checks and customer-run trust-boundary probes. No message or support action is a completion gate. See Docs authority & product state.

1. Confirm credential readiness

Role: Engineer or Admin with connector settings access.

Run automated credential validation in the guided setup. It checks the exact tenant, connector identity, trust condition, resource scope, and provider reachability. A connector cannot advance on a warning or a partially validated credential.

Success evidence: credential state is Validated, with a timestamp and scope summary.

Recovery: fix the named credential field or trust condition. Rotate the credential if its provenance is uncertain, then rerun validation.

2. Prove the read-only trust boundary

Every cloud module includes scripts/verify.sh:

Bash
cd infra/<cloud>/onboarding
./scripts/verify.sh

The script assumes the external-ID-scoped role, runs a positive read probe for each granted service, and runs deny-expected write probes. A response code alone is not proof that a mutation occurred; provider state and the authorization result determine the outcome.

The script confirms there are no user-managed service-account keys, checks the role allowlist, and proves a write is denied. Connector activation runs the positive BigQuery, Logging, and Monitoring reads through Workload Identity Federation.

The script confirms the service principal and read-role allowlist and proves a write is denied. Connector activation runs positive Cost Management, Resource Graph, Monitor, and enabled scoped telemetry reads through the federated credential.

Success evidence: the local script exits 0, automated positive reads pass, and every deny-expected write leaves provider state unchanged.

Recovery: remove any write grant immediately. For a failed read, add only the named permission at the narrowest resource scope, then rerun the failed probe and the complete boundary check.

3. Inspect attribution evidence

Role: Engineer or authorized viewer with quality-feed access.

Open the quality feed and inspect the 1st AttributionRecord produced from the connected source. Confirm:

  • source and evidence lineage;
  • identity and cost mapping;
  • coverage and explicit unknowns;
  • source and record freshness;
  • confidence and export eligibility.

Success evidence: the record is visible and its evidence links resolve to the connected source. This is the engineering active-use milestone.

Recovery: follow the record’s missing-evidence, unknown, or stale state back to the named provider, identity, cost-mapping, or deployment step. Do not replace an unknown with an unsupported value.

4. Verify persona completion

Persona-complete production onboarding is a separate gate. Product, Security, Engineering, and Finance must each complete real in-product actions. Finance completion requires acceptance of a chargeback-eligible export. There is no admin or support override.

Use the Enterprise readiness checklist for the required evidence. Support remains an optional recovery path.