Evidence & editorial policy
Keep source-backed facts separate from teaching scenarios and design proposals.
Evidence types
| Type | Meaning |
|---|---|
| Evidence-supported inference | An interpretation tied to cited evidence, with reasoning, assumptions and limits stated explicitly |
| Sourced concept / confirmed fact | A bounded technical statement linked to primary documentation and a review date |
| Hypothetical scenario | A fictional engineering question or attack exercise |
| Proposed architecture | An editorial reference pattern requiring implementation validation |
| Unverified research notes | User-captured material requiring source review |
Claim-level attribution
A source link does not validate an entire article. Each starter entry identifies the exact source-backed statement. Its surrounding company context, flow, controls and exercises remain editorial proposals.
Primary sources
- NIST SP 800-63B-4 · Authentication
- GitHub Docs · OpenID Connect
- SPIFFE · Overview
- IETF RFC 8693 · Token Exchange
Reviewed 3 November 2026. Review again when the underlying specification or implementation changes.
Framework provenance
The owner supplied Domain Framework v0.4 on 3 November 2026. Its scopes, knowledge areas, technologies, career mappings and governance principles are authoritative for this textbook. Earlier A/B outcome codes, specializations and L1–L4 levels remain supplemental learning aids.
Incident and enterprise research
For incidents, record the background, confirmed timeline, attack path, compromised identities and credentials, trust boundaries, control failures, defensive architecture and lessons learned. Label each claim as confirmed fact, evidence-supported inference or hypothetical scenario.
For enterprise research, cite public engineering articles, documentation, presentations, job descriptions or other verifiable sources. Distinguish confirmed implementations from reasonable inferences. A job requirement does not establish that the employer deployed a technology.
MVP limits
No real company architecture, incident or employer requirement is claimed by the starter content. Research and reading progress are local to this browser. There is no account sync or assessed competence. Labs & Projects are planned for a future release.