{"id":"sec-it-identity-config-baseline","audience":"it-security","category":"security","track":"security","technique":"context","title":"Check an identity config against your security baseline","free":false,"task":"Review this exported identity and storage config against your company baseline: passwords at least 14 characters, MFA required for every user, legacy sign-in protocols blocked, storage buckets private, and sessions of 12 hours or less. List only the settings that break the baseline, as numbered lines like '1. setting: current value -> baseline value'. Plain text, under 70 words.","materialLabel":"Exported config (attached to your prompt automatically)","material":"# tenant: harborline-example | exported 2026-11-03 by r.iyer\nidentity:\n  password_policy:\n    min_length: 8\n    require_complexity: true\n    max_age_days: 0          # no forced expiry\n  mfa:\n    required_for: admins_only\n    methods: [authenticator_app, sms]\n  legacy_auth:\n    imap_pop_smtp_basic: allowed\n  sessions:\n    max_session_hours: 8\n    idle_timeout_minutes: 30\nstorage:\n  buckets:\n    - name: finance-reports\n      access: private\n    - name: marketing-assets\n      access: public-read\n    - name: hr-scans\n      access: private\nlogging:\n  sign_in_logs: enabled\n  audit_logs: enabled\n  retention_days: 90\n  export_to: siem-collector-01\ndevices:\n  require_disk_encryption: true\n  block_jailbroken_phones: true\n  os_update_grace_days: 14\nguest_access:\n  allow_external_guests: true\n  guest_invite_by: admins_and_owners\n\n# Change history\n# 2026-06-12 r.iyer: raised idle timeout from 15 to 30 minutes after complaints from the warehouse team\n# 2026-08-01 m.boateng: added marketing-assets bucket for the new website image library\n# 2026-09-20 r.iyer: SMS added as a backup MFA method for field staff without smartphones\n# Reason for this export: annual audit prep. Last year's review found 2 issues, both fixed.","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":70}],"mistakes":[{"title":"Not giving the baseline","why":"Without your rules, the AI judges against its own idea of best practice and flags extra things.","fix":"Paste the rules: \"Baseline: passwords 14+, MFA for all, legacy auth blocked, buckets private, sessions 12 hours or less.\"","checks":["r1"]},{"title":"A security essay","why":"The AI writes sections of general hardening advice, not a list of what breaks your baseline.","fix":"Add: \"List only settings that break the baseline, one numbered line each.\"","checks":["r0","numberedItems"]},{"title":"Vague fixes","why":"The AI says 'strengthen the password policy' instead of the value to set.","fix":"Show the shape: \"setting: current value -> baseline value.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 70 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 50 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the change ticket they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the baseline","patterns":["baseline","14","12 hours","private"]},{"label":"Lists only failures","patterns":["only (the )?(settings|failures|issues|ones)","break","fail","violat"]},{"label":"Shows the line shape","patterns":["->","current value","baseline value","current.{0,20}(should|target|required)"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"The AI can't know your company's baseline, so it grades against its own. Paste the baseline and ask for only the settings that break it, with current and target values.","rubricLabels":["Lists exactly these 4 issues: min_length 8 (needs 14), MFA admins_only (needs all users), legacy auth allowed (needs blocked), and the marketing-assets bucket public-read (needs private)","Does not flag the 8-hour session limit, the lack of password expiry, SMS as an MFA method, or the 90-day log retention as baseline failures","Each line shows the current value and the baseline value (for example 'min_length: 8 -> 14')"]}