Discovery plane
HKGpipi reads the AWS evidence explicitly permitted by a constrained role to understand cost and infrastructure evidence. Discovery write permissions are not needed for Savings Sprint analysis.
SECURITY
Read what we need.
Change nothing without you.
Discovery begins with tightly constrained read-only AWS access. Production changes remain inside your existing engineering, review and deployment controls.
Known boundary
Read-only discovery access.Customer-controlled production.
01 · Two control planes
Separate evidence access from change authority.
Implementation plane
Approved remediation enters the customer's repository or ticketing process and follows customer review, checks, approval and deployment control.
02 · Access boundary
Constrained access for bounded discovery.
Can / cannot matrixDiscovery boundary
| Area | Can | Cannot / does not require |
|---|---|---|
| AWS evidence | Read information explicitly permitted by the constrained role | Unrestricted administrative access is not required for discovery |
| Opportunity work | Use permitted evidence to identify and validate opportunities | Independently deploy AWS changes |
| Approval | Prepare findings for customer decision | Bypass customer change approval |
Engagement-specific review
The discovery role is intended to be constrained to read-only permissions. The exact engagement-specific policy is reviewed before access is granted.
03 · Change control
No parallel deployment process.
Remediation work moves through the customer's established controls before it reaches production.
- HKGpipi remediation
- Customer repository / ticketing process
- Customer review
- CI / checks
- Customer approval
- Customer-controlled deployment
04 · Least access
Keep access narrow.
Access should be constrained to the accounts, services, data categories and duration needed for the agreed work. The engagement-specific access model is reviewed before AWS access is granted.
05 · Assurance boundary
Formal assurance and data-handling documentation.
Security certifications, retention commitments, data-residency terms, subprocessors and formal assurance documents are published only when they are established and approved.
No implied assurance
Absence of a published document or claim should not be interpreted as evidence that it exists.
06 · Before access
Give security teams a concrete review surface.
Before access is granted, security teams can review the requested AWS permission scope, intended data categories, engineering workflow boundary and verification access requirements.