[LLM-template-generated document — held-out corpus for d027 evaluation; not human-authored.]

# Postmortem: suspicious access pattern — Tuesday afternoon

**Severity**: SEV-3 (contained)
**Author**: Elena (security), Jamal (platform)

## Summary

The security-monitoring pipeline flagged an unusual pattern of read requests against the sync-orchestrator audit endpoint from a single service account. Investigation confirmed the requests were legitimate — a batch job that had been ramped up without notifying the security team — but the detection surfaced a gap in our access-change workflow.

## Findings

- No unauthorised access occurred
- The batch job's traffic profile changed on Thursday following a config bump
- The change-management ticket referenced sync-orchestrator but did not call out the traffic-profile shift

## Action items

- Extend change-management template to include traffic-profile expectations (owner: Jamal)
- Publish a lightweight approval path for service-account traffic changes
- - Add the circuit-breaker rollout scenario to the on-call training rotation for the next quarter
- Schedule a table-top exercise for the access-change workflow
