Synthetic example · not client work or measured evidence

Sample cryptographic inventory

For application owners locating dependencies and missing evidence.

Scenario: a fictional document-sharing SaaS application. Scope includes one application, its service connection, and its identity dependency. All owners and evidence below are illustrative; no customer system was inspected.

Boundary and evidence

Scope: One fictional document application, a worker connection, and an identity dependency. No runtime, network, certificate-store, or cloud-account inspection was performed.
Evidence register: E-01: fictional manifest declaring jose. E-02: fictional architecture showing HTTPS between application and worker. E-03: supplier questions, unanswered. These are authored examples, not collected files.

Asset register

APP-01 · identity dependency: Role: token signing or verification to confirm. Library: jose; version unknown. Owner: application owner, unconfirmed. Source: E-01. A declaration does not prove execution or algorithm choice. Action: confirm reachability, version, and actual role.
CONN-01 · service connection: Role: transport confidentiality and peer authentication. Protocol: HTTPS; TLS version and negotiated algorithms unknown. Owner: platform owner, unconfirmed. Source: E-02. Action: obtain approved configuration and negotiation evidence; do not infer end-to-end protection from a diagram.

Coverage review and handoff

Gaps: Transitive dependencies, actual token algorithms, trust stores, provider termination points, and deployed versions remain unknown. No absence-of-risk conclusion is possible.
Completion gate: Customer owners review the boundary and evidence gaps. Carry APP-01 and CONN-01 into assessment only with their uncertainty preserved. Inventory delivery does not establish complete discovery.