جاهزية للتدقيق كل يوم، لا في أسبوع التدقيق فقط

Access to production systems is granted through a managed identity, is removed when that identity is removed, and cannot be obtained by any route that bypasses it.

Access Control Policy v4, line 41: single sign-on is mandatory for all production systems and local accounts are prohibited. The agent then verified that claim against the identity provider — 5 of 5 production systems are federated and no local account exists on any of them. The policy states the obligation; the test is what passes the control.