Automated De-provisioning & Access Modification Attestation

Organization: WTD Application Project

This document attests that the WTD application has implemented automated procedures to ensure that access to sensitive resources and the Plaid API environment is immediately modified or revoked when a user’s status changes or their requirement for access is terminated.

1. Definition of "Terminated Status"

In the context of WTD (a personal/family application), "Termination" is defined as any instance where a user is no longer authorized to access the system (e.g., a family member leaving the household, a compromised account, or a lost device). "Transfer" refers to a change in user roles (e.g., moving from a Standard User to a Read-Only role).

2. Automated Revocation Workflow

WTD utilizes a centralized user management system. The de-provisioning process is "automated" via the following system-level behaviors:

Cascading Invalidation: Upon the Administrator’s action to delete or deactivate a user account, the system automatically invalidates all active JWT (JSON Web Tokens) and session cookies associated with that User ID.
Database Integrity: Foreign key constraints and automated cleanup scripts ensure that a deactivated user can no longer authenticate with the backend API or trigger calls to the Plaid Link module.
Network-Level Isolation: If a user is removed from the organization, their unique identity-based access (e.g., Tailscale node access) is automatically revoked at the network layer.

3. Modification of Access

When a user’s role is modified (e.g., from Administrator to Standard User), the WTD application automatically updates the user's permission set across all application modules. These changes take effect upon the next API request, ensuring the Principle of Least Privilege is enforced in real-time without manual configuration of individual resource permissions.

4. Statement of Compliance

I attest that the WTD application is architected to prevent "stale" access. The removal of a user from the primary configuration automatically propagates throughout the application stack, ensuring immediate cessation of access to all Plaid-integrated data and services.