# Draft post-incident report — INC-2026-0902

*This is a draft assembled from stored records. Nothing in it has been adopted, approved or signed off by anyone. Adoption is a registered action that goes through policy evaluation and leaves its own audit record; if this document were adopted, that record — not this file — would be the evidence of it.*

- **Incident:** `INC-2026-0902`
- **Document:** post_incident (draft)
- **Generated:** 2026-10-30T05:59:40.116907+00:00
- **Source:** https://265d0hsmwa.execute-api.us-east-1.amazonaws.com/api/v1/incidents/INC-2026-0902/draft/post_incident/export

## What happened *(draft)*

- A phishing link led to an OAuth consent, and the resulting token — not a password — is what read the mailbox. (confidence 0.91)
  - *evidence:* `INC-2026-0902#hypothesis-0`, `SEC-0002-b`, `SEC-0002-c`, `SEC-0002-d`, `SEC-0002-e`
- asset:m.okafor-mailbox — message from a lookalike domain delivered
  - *evidence:* `INC-2026-0902#chain-0`, `SEC-0002-a`
- asset:oauth-app-Rep0rt-Sync — OAuth consent granted to an unfamiliar application
  - *evidence:* `INC-2026-0902#chain-1`, `SEC-0002-b`, `SEC-0002-c`
- asset:m.okafor-mailbox — mailbox read in bulk by the issued token
  - *evidence:* `INC-2026-0902#chain-2`, `SEC-0002-d`

## What was ruled out *(draft)*

- Ruled out: The account's password was compromised and used to sign in.
  - *evidence:* `INC-2026-0902#hypothesis-1`, `SEC-0002-e`, `SEC-0002-c`

## What was done *(draft)*

- Nothing was executed. The plan was drawn up and did not run.
  - *evidence:* `INC-2026-0902`

## What was verified *(draft)*

- No verification is recorded, so nothing here says the incident was resolved rather than merely closed.
  - *evidence:* `INC-2026-0902`

## Provenance

Every assertion above cites the records it rests on; 11 distinct reference(s) in total.

Audit records for this incident, against which the above can be reconstructed:

- `2026-10-19T00:23:18.417043+00:00 · policy_evaluation · dharma — awaiting approval — revoke_session scores 25 → approval tier`
- `2026-10-19T00:23:18.417036+00:00 · observation · agent:analyst — diagnosed — no password authentication in the window — this is a token, not a credential`
- `2026-10-19T00:23:18.417028+00:00 · observation · agent:sentinel — correlated — delivery, click, consent and bulk read on one account within 31 minutes`
- `2026-10-18T23:24:18.416639+00:00 · observation · drishti — no password authentication event for m.okafor in the window`
- `2026-10-18T23:23:18.416639+00:00 · observation · drishti — mailbox read in bulk using the new token`
- `2026-10-18T23:04:58.416639+00:00 · hypothesis · buddhi — The account's password was compromised and used to sign in. (4%) · ruled out by SEC-0002-e, SEC-0002-c`
- `2026-10-18T23:04:58.416639+00:00 · hypothesis · buddhi — A phishing link led to an OAuth consent, and the resulting token — not a password — is what read the mailbox. (91%)`
- `2026-10-18T23:03:18.416639+00:00 · observation · drishti — token issued to 'Rep0rt Sync', an application never consented to before`
- `2026-10-18T23:00:18.416639+00:00 · observation · drishti — proxy log records the link being followed`
- `2026-10-18T22:53:18.416639+00:00 · observation · drishti — message from rn1crosoft-billing.com delivered to m.okafor`

*Exported documents do not update. An incident can reopen, a verification can land and an execution can be rolled back after this was written, and nothing on this page would show it. Check the references against the source before relying on it.*

*Adopting this would require the registered action `adopt_report`, which is scored and routed through policy evaluation like any other action. This file is not that.*