Finding ENT-F1 is small and it changed how Plimsoll SI works. deskbook's first line support role held a wildcard grant: internal material on every desk, through one line in the entitlement configuration. The access policy said that role needs support and operations material only.
Why the test missed it
In run C the statement of who may read what was identical to deskbook's own entitlement configuration. A leak test asks the system a question as a role and checks the reply against that statement. If the statement is the system's own configuration, the system always agrees with it. The over broad grant was invisible by construction.
The same pattern showed with planted faults. Of five permission faults planted in deskbook's configuration, a test judged by the configuration caught 3. A test judged by a separate statement of intended access caught 5.
What found it
From 28 September 2026 the statement is derived by a script from two files only, an HR roster and a plain access policy, with the digest of each input in its header. The script imports nothing from deskbook. Judged against it, retrieval for first line support on trading desk internal questions was a leak, and the same wildcard had widened a reporting tool's grant too.
The fix followed the policy rather than amending it: the wildcard moved to second line support, which the policy allows, and was verified live the same day. A test keeps the old grant around and checks that the derived statement still catches it.
The caveat we keep printing
The roster and the policy were written by the same developer who wrote deskbook. They are textually separate, not organisationally separate, so they demonstrate the method rather than stand in for a bank's source of record. Importing access rules on the policy page from where a company already keeps them, rather than typing them again, follows the same idea.