# Federation trust review packet

Proposed review structure. Use restricted evidence references, not secrets. Labels are not a vendor log schema.

- Review owner and incident/change reference:
- Time window and timezone:
- Business sponsor, approved source operator and intended users:
- Approved applications and exclusions:
- Source IdP object identifier and configuration version:
- Issuer and signing-material references:
- Account matching/linking and provisioning settings:
- Prior/current configuration comparison and unknowns:
- Administrative change actor, outcome and time:
- Correlated authentication identity, source, outcome and time:
- Application operation, result and time:
- Supported conclusion; unsupported conclusions to avoid:
- Response owner and separate session/application follow-up:
- Approved retest: permitted case, excluded case, expected outcomes:
- Observed retest results, limitations and next checkpoint:

Do not infer resource access from a configuration event. Existing sessions require separate review. No production change or live test is authorized by this worksheet.

Sources: https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection/ ; https://help.okta.com/oie/en-us/content/topics/security/idp-add-saml.htm ; https://developer.okta.com/docs/reference/api/event-types/