Etowah Lane Equipment Rental / BG-Demo – Security Review
Callcompleted
Etowah Lane Equipment Rental · 1 Sep 2026 16:15
Tobias Renwick showed time-bound access working in a test tenant. Ravi Subramanian called it a substantial improvement but cannot close standing access without production evidence, and gave no date.
What was said
What this says
As at Fri 9 Oct 2026Tobias Renwick showed time-bound access working in a test tenant. Ravi Subramanian called it a substantial improvement but cannot close standing access without production evidence, and gave no date.
What happened: In session two on 1 Sep 2026, Tobias Renwick demonstrated requested, approved, time-bound access in a test tenant, with Theo Gallagher tracking evidence. Four findings were open going in.
Customer view: Ravi Subramanian called it a substantial improvement but wants production revocation samples and the approver list export. Findings two and four stay open, and he has one question on the sub-processor list.
Commercial: Theo said Jordan Pike is working back from 4 Dec 2026. Ravi replied that his review concludes when findings close, not when a date arrives.
Watch: Six actions are owed, including break-glass usage and signed weekly reviews. The approver list needs the platform team lead's confirmation, and the residency statement is still a draft.
Themes
As at Fri 9 Oct 2026Theme
Security review, access evidence
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Theo Gallagher to send the sample of production revocations, break-glass usage record, completed reviews and draft residency statement before the next session.
- Theo Gallagher to confirm the approver list with the platform team lead before attaching the export.
- Tobias Renwick to write the per-role statement of who can see production data.
Risks
As at Fri 9 Oct 2026- The 4 Dec 2026 working date moves with Ravi's review and may slip if evidence arrives late.
- Finding two stays open until signed reviews and the break-glass usage answer are supplied.
- The data residency statement is still only a draft, so finding four cannot close.
Opportunities
As at Fri 9 Oct 2026- Ravi's requests are specific and deliverable, so findings can close once production evidence is sent.
Transcript
Theo GallagherHello Ravi, can you hear me all right? I've got you on the recording indicator, so I think we're live.
Ravi SubramanianYes, I can hear you. Good morning from Atlanta, though I imagine it's well into the afternoon for you.- Theo GallagherIt's just gone four, yes. Raining, naturally. How's your side? Bit warmer, I'd guess.
- Ravi SubramanianHumid. It has been humid since June and I have stopped expecting that to change. Is Tobias joining?
- Theo GallagherHe is, he's just finishing something. Ah, here he is.
Tobias RenwickApologies, I was at the end of another call and it ran over. Good afternoon, Ravi. Good to see you again.- Ravi SubramanianAnd you. Shall we go straight in? I have a limited window and I would like to use it on the findings.
- Theo GallagherPlease. I'll list where we are so we're all reading from the same page. For the record this is session two, 1 Sep 2026. There are four open findings from session one. Finding one is standing engineer access to customer environments, owner Tobias. Finding two is the post-incident actions, also Tobias. Finding three is the sub-processor list, which is mine, and I sent the updated version last week. Finding four is the data residency statement, also mine, and that one is drafted but I would not call it final.
- Ravi SubramanianThank you. That matches my own list. I would like to take finding one first, because the others depend on it. My question is the same as in session one. Who has standing access?
- Tobias RenwickRight. Before I answer, may I ask what your security team will need to see from this session? I would rather show you the thing that closes the finding than talk around it.
- Ravi SubramanianEvidence. Not a description of the process, the process itself operating. A request, an approval, a grant, an expiry and a log entry for each, tied together.
- Tobias RenwickGood, that is exactly what I have prepared. To be precise, the answer to your question is that no engineer at BG-Demo holds standing access to a customer environment. Our product runs inside the customer's own Snowflake account, so the access we are talking about is a role the customer's account grants us, and the point of the change is that the role does not exist for any individual until it is requested.
- Ravi SubramanianAnd before the change? I want that stated plainly in the record.
- Tobias RenwickBefore the change there was a support role that a small group of engineers held continuously. That was the finding, and you were right to raise it. The honest answer is that it was convenient and it was wider than it needed to be.
- Ravi SubramanianMm. Thank you for saying so directly. Please go on.
- Tobias RenwickI'm going to share my screen. Give me a moment. Can you see a terminal and a browser window?
- Ravi SubramanianI can see both. The text is small. Could you enlarge the browser?
- Tobias RenwickBetter? Good. This is a real request from our test tenant, not a mock-up, and I'll say which parts are test and which are the production mechanism. The mechanism is identical. An engineer opens a request that names the environment, the reason and a ticket reference. They cannot submit without all three.
- Theo GallagherAnd the control reference for that is the access management policy, section on privileged requests. We can evidence that the reason field is mandatory, you'll see it fail in a second if Tobias leaves it blank.
- Tobias RenwickYes, let me do that. Blank reason, submit. There. Rejected at the form, and the rejection itself is logged. Now with a reason.
- Ravi SubramanianWho approves it? The requester's manager?
- Tobias RenwickNot the manager. A named approver who is not the requester and not in the requester's reporting line, and for a customer environment that approval is also visible to the customer's own administrator. The trade-off is that it is slower than a standing role. We decided that was acceptable.
- Ravi SubramanianPlease evidence that the requester cannot approve their own request. Not that the policy says so. That the system refuses.
- Tobias RenwickFair. I'm going to log in as the requester and try to approve. Okay, that is the approval button, and it is greyed out. If I force it through the interface directly, which I'm doing now, I get an authorisation error, and there it is in the audit trail with my own identity against it.
- Ravi SubramanianGood. Continue.
- Tobias RenwickNow as the approver. I approve, with a window. The window is set per request, and there is a ceiling of one working day that nobody can exceed without raising a new request. On approval the system creates a time-bound grant. Nothing is added to the engineer's identity permanently. The grant simply carries an end time.
- Ravi SubramanianWho has standing access to the approval function itself? That is the part I always ask next.
- Tobias RenwickA very small group, and I'm one of them, which is the reason I would like it reviewed by someone outside my team. I will come to the review in the second action. The list is exported here, and you will notice that the platform team lead is on it. Theo, I'd rather you didn't speak to that one without checking with him.
- Theo GallagherAgreed. I'll confirm with the platform team lead before I put anything in writing about who is on that list, and I'll attach the export once he has confirmed it.
- Ravi SubramanianI would like that in the minutes. Continue with expiry. A grant that is supposed to expire is only a promise until I see it expire.
- Tobias RenwickUnderstood. I have a grant here that was created earlier today with a short window specifically for this call. Let me refresh. The status is still active. We have a minute or so, so let me show you the log while we wait.
- Tobias RenwickThis is the session log. Every query the engineer ran under the grant is recorded with the grant identifier, so you can walk from a single query back up to the request, the reason and the approver. Nothing runs under the role without the identifier. That is how a reviewer, yours or ours, reconstructs what happened.
- Ravi SubramanianCan an engineer alter or delete those log entries?
- Tobias RenwickNot with the role they are granted. The log is written to a store the engineering role has no write permission on. I can show you the permission set if you would like, and then the expiry should have fired. Refreshing now. Status expired. And here is the revocation event, a little after the end time.
- Ravi SubramanianThe gap between the end time and the revocation. That is how long?
- Tobias RenwickIn this case under a minute. I won't promise a figure beyond what this run shows, because it depends on the scheduler, and I would rather give you the log from several real revocations than a single number. Theo, can you add that to the evidence pack?
- Theo GallagherYes. I'll export a sample of revocations with their end times and revocation times, so you can read the gap yourself. Dated, and marked as a sample so nobody mistakes it for the full set.
- Ravi SubramanianThat is acceptable. What about emergencies? A production fault at night does not wait for a two-person approval.
- Tobias RenwickThere is a break-glass path, and I would be misleading you if I said it was as tight as the normal path. The trade-off is speed against assurance. It needs two approvers, it grants a narrower role, it alerts our security channel the moment it is used, and every use is reviewed afterwards as if it were an incident. If it were used without a matching fault ticket, that would itself be a finding.
- Ravi SubramanianHow many times has it been used?
- Tobias RenwickI do not have that number in front of me and I am not going to estimate it. I will ask for the usage record and Theo will include it. If the answer is not zero, I would rather you saw each instance.
- Ravi SubramanianGood. Now the second finding. What's your incident history, and what changed because of it?
- Tobias RenwickLet me stop sharing and speak to it directly. The review document from the incident was shared with you after session one, and it is written in the blameless format we use, so it describes what the system allowed rather than who did what. Two actions came out of it, and I'll take them in order.
- Tobias RenwickThe first action is the one you have just watched. We removed the standing support role entirely and moved every engineer to requested, time-bound access. That was not a policy memo, it was a permission change, and the old role no longer exists in the customer templates. The second action is about detection. Previously a grant of elevated access would have been visible only to someone who went looking. Now every grant, every break-glass use and every failed approval attempt raises an alert, and a second person who was not involved reviews the week's grants and signs the review.
- Ravi SubramanianSigns it where? And can I see a signed review? A description of a weekly review is exactly what I would call assurance.
- Theo GallagherThat's fair, Ravi, and I'd rather be exact about what we have today. We have the review template and the schedule. We have completed reviews from recent weeks, and I can evidence those. What I cannot do is hand you a long history, because the process is new. I'll send the completed reviews, with the reviewer names redacted down to role, and I'll say clearly how many there are when I send them.
- Ravi SubramanianRedacted to role is acceptable for the first pass. If I need names, I will ask. Next. Was any customer data accessed during the incident?
- Tobias RenwickThe review document answers that in its own words and I would rather you read those than my paraphrase of them, because I do not want to say something here that is looser than what is written there. If the document leaves a question unanswered for you, write it down and we will answer it in the same format.
- Ravi SubramanianUnderstood. I will mark that I have read it and that two of my questions are not answered by it. I'll send them after this call, numbered.
- Theo GallagherPlease do. We'll reply to each by number and attach evidence where there is any, and say so where there is none.
- Ravi SubramanianNow, a different matter. In the first session your team offered a reference customer. I should be clear that I will not accept a reference customer in place of a control.
- Theo GallagherUnderstood, and I won't offer it as a substitute. The controls stand on their own evidence.
- Ravi SubramanianThank you. And on the timeline. I understand the commercial team is working to a date. I do not discuss price or the commercial side, that sits with your account owner and our procurement. My review concludes when the findings are closed, not when a date arrives.
- Theo GallagherCompletely fair. For context only, Jordan has been working back from 4 Dec 2026, but that moves with your review, not the other way round. I'll tell Jordan exactly that.
- Ravi SubramanianGood. Let me give you my position on finding one. I have seen the request, the approval, the refusal of self-approval, the grant, the expiry and the log. That is a substantial improvement on session one. I cannot close it today, because I have seen a test tenant and I want the sample of production revocations and the export of the approver list.
- Tobias RenwickThat seems entirely reasonable. I would not want you to close it on the basis of a test tenant either.
- Ravi SubramanianFinding two remains open until I have the signed reviews and the answer on break-glass use. Finding three, I have read the updated sub-processor list. I have one question on it, which I'll put in my numbered list. Finding four, I have not seen a final statement.
- Theo GallagherNo, and I'd rather not call the draft final. I'll send the draft marked as a draft, with the open points listed, and you can tell me whether the shape is right before we finalise it.
- Ravi SubramanianThat is the correct way to do it. Please also state, in the pack, who at BG-Demo can see the production data of a customer and under what conditions. One sentence per role.
- Tobias RenwickNoted. I will write that myself so that it is precise, and Theo will check it against the access list before it goes out.
- Ravi SubramanianThen I think we have used the session well. Please send the pack before the next one, in a form I can forward to the audit committee without rewriting.
- Theo GallagherWill do. To summarise the actions so there's no doubt. One, a sample of production revocations with their end and revocation times. Two, the approver list export, once the platform team lead has confirmed it. Three, the break-glass usage record. Four, the completed weekly reviews, redacted to role. Five, the draft residency statement, marked as a draft. Six, Tobias's per-role statement of who can see production data. And we'll answer your numbered questions by number when they arrive.
- Ravi SubramanianThat agrees with my notes. Thank you both. I will send my questions today.
- Tobias RenwickThank you, Ravi. This was a more useful session than the first, I think, and that is largely because you asked for the thing itself. Best of luck with the rest of your day.
- Theo GallagherThanks, Ravi. Speak soon.
- Ravi SubramanianGoodbye.
Callsmade from