Verify & confirm¶
Verification is completed by automated in-product checks and customer-run trust-boundary probes. No message or support action is a completion gate. See Docs authority & product state.
1. Confirm credential readiness¶
Role: Engineer or Admin with connector settings access.
Run automated credential validation in the guided setup. It checks the exact tenant, connector identity, trust condition, resource scope, and provider reachability. A connector cannot advance on a warning or a partially validated credential.
Success evidence: credential state is Validated, with a timestamp and
scope summary.
Recovery: fix the named credential field or trust condition. Rotate the credential if its provenance is uncertain, then rerun validation.
2. Prove the read-only trust boundary¶
Every cloud module includes scripts/verify.sh:
The script assumes the external-ID-scoped role, runs a positive read probe for each granted service, and runs deny-expected write probes. A response code alone is not proof that a mutation occurred; provider state and the authorization result determine the outcome.
The script confirms there are no user-managed service-account keys, checks the role allowlist, and proves a write is denied. Connector activation runs the positive BigQuery, Logging, and Monitoring reads through Workload Identity Federation.
The script confirms the service principal and read-role allowlist and proves a write is denied. Connector activation runs positive Cost Management, Resource Graph, Monitor, and enabled scoped telemetry reads through the federated credential.
Success evidence: the local script exits 0, automated positive reads pass,
and every deny-expected write leaves provider state unchanged.
Recovery: remove any write grant immediately. For a failed read, add only the named permission at the narrowest resource scope, then rerun the failed probe and the complete boundary check.
3. Inspect attribution evidence¶
Role: Engineer or authorized viewer with quality-feed access.
Open the quality feed and inspect the 1st AttributionRecord produced from the
connected source. Confirm:
- source and evidence lineage;
- identity and cost mapping;
- coverage and explicit unknowns;
- source and record freshness;
- confidence and export eligibility.
Success evidence: the record is visible and its evidence links resolve to the connected source. This is the engineering active-use milestone.
Recovery: follow the record’s missing-evidence, unknown, or stale state back to the named provider, identity, cost-mapping, or deployment step. Do not replace an unknown with an unsupported value.
4. Verify persona completion¶
Persona-complete production onboarding is a separate gate. Product, Security, Engineering, and Finance must each complete real in-product actions. Finance completion requires acceptance of a chargeback-eligible export. There is no admin or support override.
Use the Enterprise readiness checklist for the required evidence. Support remains an optional recovery path.