{
 "_comment": "Fictional closed and cancelled u_identity_finding records in the Table API's result shape, for evidence_export.py. IDF0000903's u_evidence was edited after it closed, and IDF0000905 was closed with no evidence; both should be reported. Every identifier is invented.",
 "result": [
  {
   "sys_id": "b0000000000000000000000000000901",
   "number": "IDF0000901",
   "state": "3",
   "u_drift_class": "unauthorized_write",
   "u_source": "sailpoint-isc",
   "u_severity": "P3",
   "priority": "3",
   "assignment_group": "Identity Operations",
   "assigned_to": "",
   "u_detected_at": "2026-10-20 14:00:00",
   "opened_at": "2026-10-20 14:00:00",
   "due_date": "2026-10-21 14:00:00",
   "u_origin": "{\"trigger_id\":\"idn:native-change-account-updated\",\"workflow\":\"Drift to ServiceNow - native change (provenance)\"}",
   "u_intended_state": "{\"attributes\":{\"title\":\"Analyst\"}}",
   "u_evidence": "{\"checked_at\":\"2026-10-21T09:00:00Z\",\"checker\":\"reread_verification.py/0.1.0-pass1\",\"checker_identity\":\"REPLACE-WITH-ISC-CLIENT-ID\",\"differences\":[],\"intended_state\":{\"attributes\":{\"title\":\"Analyst\"}},\"match\":true,\"query\":\"GET /v3/accounts/2c91800000000000000000000a1001ad\",\"record\":\"IDF0000901\",\"record_sys_id\":\"b0000000000000000000000000000901\",\"result_sha256\":\"82c3dd9a9cf2af3e04fa6fb012c815f92982935e7f3b5cd8b7aea685ead52db2\",\"system\":\"isc_account\"}",
   "u_evidence_hash": "ec5f3a49b19e4a48666778c326579dbdbf1d058eb208144f1e23a5d6113d85a9",
   "u_verified_at": "2026-10-21 09:00:00",
   "close_notes": "Closed on re-read: GET /v3/accounts/2c91800000000000000000000a1001ad at 2026-10-21T09:00:00Z; result sha256 82c3dd9a9cf2af3e04fa6fb012c815f92982935e7f3b5cd8b7aea685ead52db2.",
   "closed_at": "2026-10-21 09:00:00"
  },
  {
   "sys_id": "b0000000000000000000000000000902",
   "number": "IDF0000902",
   "state": "3",
   "u_drift_class": "stale_access",
   "u_source": "drift-reconciliation",
   "u_severity": "P2",
   "priority": "2",
   "assignment_group": "Identity Operations",
   "assigned_to": "",
   "u_detected_at": "2026-10-21 09:00:00",
   "opened_at": "2026-10-21 09:00:00",
   "due_date": "2026-10-21 10:00:00",
   "u_origin": "{\"type\":\"drift-reconciliation\",\"finding_id\":\"c687d8f1a72b2a3f\",\"checker\":\"identity_drift.py/0.1.0-pass1\"}",
   "u_intended_state": "{\"accountEnabled\":false}",
   "u_evidence": "{\"checked_at\":\"2026-10-21T13:00:00Z\",\"checker\":\"reread_verification.py/0.1.0-pass1\",\"checker_identity\":\"REPLACE-WITH-ISC-CLIENT-ID\",\"differences\":[],\"intended_state\":{\"accountEnabled\":false},\"match\":true,\"query\":\"GET https://graph.microsoft.com/v1.0/users/00000000-0000-0000-0000-000000001002?$select=id,accountEnabled,department,employeeId,jobTitle\",\"record\":\"IDF0000902\",\"record_sys_id\":\"b0000000000000000000000000000902\",\"result_sha256\":\"06c2996e2794be11677f6b7f53300fb1fcecb2d897d9c161938b9797a683d77a\",\"system\":\"entra_user\"}",
   "u_evidence_hash": "d81ea2a61ba13b269c9d3f514d27731682708d4c074dfcdb6598e8877c06e56b",
   "u_verified_at": "2026-10-21 13:00:00",
   "close_notes": "Closed on re-read: GET https://graph.microsoft.com/v1.0/users/00000000-0000-0000-0000-000000001002?$select=id,accountEnabled,department,employeeId,jobTitle at 2026-10-21T13:00:00Z; result sha256 06c2996e2794be11677f6b7f53300fb1fcecb2d897d9c161938b9797a683d77a.",
   "closed_at": "2026-10-21 13:00:00"
  },
  {
   "sys_id": "b0000000000000000000000000000903",
   "number": "IDF0000903",
   "state": "3",
   "u_drift_class": "stale_access",
   "u_source": "drift-reconciliation",
   "u_severity": "P2",
   "priority": "2",
   "assignment_group": "Identity Operations",
   "assigned_to": "",
   "u_detected_at": "2026-10-21 10:30:00",
   "opened_at": "2026-10-21 10:30:00",
   "due_date": "2026-10-21 11:30:00",
   "u_origin": "{\"type\":\"drift-reconciliation\",\"finding_id\":\"c687d8f1a72b2a3f\",\"checker\":\"identity_drift.py/0.1.0-pass1\"}",
   "u_intended_state": "{\"disabled\":true}",
   "u_evidence": "{\"checked_at\":\"2026-10-22T09:00:00Z\",\"checker\":\"reread_verification.py/0.1.0-pass1\",\"checker_identity\":\"REPLACE-WITH-ISC-CLIENT-ID\",\"differences\":[],\"intended_state\":{\"disabled\":true},\"match\":true,\"query\":\"GET /v3/accounts/2c91800000000000000000000a1002ad\",\"record\":\"IDF0000903\",\"record_sys_id\":\"b0000000000000000000000000000903\",\"result_sha256\":\"593286d841222ff2d776f4684da88b7354812ae5be15f8595d028a4045d46330\",\"system\":\"isc_account\"}",
   "u_evidence_hash": "5a5704904f82a32d4e14d17d247268ba7c94a470f801d60026c95237a7832f7f",
   "u_verified_at": "2026-10-21 11:00:00",
   "close_notes": "Closed on re-read: GET /v3/accounts/2c91800000000000000000000a1002ad at 2026-10-21T11:00:00Z; result sha256 593286d841222ff2d776f4684da88b7354812ae5be15f8595d028a4045d46330.",
   "closed_at": "2026-10-21 11:00:00"
  },
  {
   "sys_id": "b0000000000000000000000000000904",
   "number": "IDF0000904",
   "state": "7",
   "u_drift_class": "unauthorized_write",
   "u_source": "sailpoint-isc",
   "u_severity": "P2",
   "priority": "2",
   "assignment_group": "Identity Operations",
   "assigned_to": "",
   "u_detected_at": "2026-10-21 12:00:00",
   "opened_at": "2026-10-21 12:00:00",
   "due_date": "2026-10-21 13:00:00",
   "u_origin": "{\"trigger_id\":\"idn:native-change-account-updated\",\"workflow\":\"Drift to ServiceNow - native change (provenance)\"}",
   "u_intended_state": "{\"disabled\":true}",
   "u_evidence": "",
   "u_evidence_hash": "",
   "u_verified_at": "",
   "close_notes": "Declared exception EXC-0042: legacy payroll appliance has no API; recorded session approved by the system owner, end date 2026-12-31.",
   "closed_at": ""
  },
  {
   "sys_id": "b0000000000000000000000000000905",
   "number": "IDF0000905",
   "state": "3",
   "u_drift_class": "stale_access",
   "u_source": "drift-reconciliation",
   "u_severity": "P2",
   "priority": "2",
   "assignment_group": "Identity Operations",
   "assigned_to": "",
   "u_detected_at": "2026-10-21 12:30:00",
   "opened_at": "2026-10-21 12:30:00",
   "due_date": "2026-10-21 13:30:00",
   "u_origin": "{\"type\":\"drift-reconciliation\",\"finding_id\":\"c687d8f1a72b2a3f\",\"checker\":\"identity_drift.py/0.1.0-pass1\"}",
   "u_intended_state": "{\"disabled\":true}",
   "u_evidence": "",
   "u_evidence_hash": "",
   "u_verified_at": "",
   "close_notes": "done",
   "closed_at": ""
  }
 ]
}
