Etowah Lane Equipment Rental / BB-Demo – Security Review
Callcompleted
Etowah Lane Equipment Rental · 2026-09-01 16:15
Tobias Renwick showed time-bound access working in a test tenant. Ravi Subramanian called it a substantial improvement but cannot close standing access without production evidence, and gave no date.
What was said
What this says
Current to 13 Oct 26Tobias Renwick showed time-bound access working in a test tenant. Ravi Subramanian called it a substantial improvement but cannot close standing access without production evidence, and gave no date.
What happened: In session two on 1 Sep 2026, Tobias Renwick demonstrated requested, approved, time-bound access in a test tenant, with Theo Gallagher tracking evidence. Four findings were open going in.
Customer view: Ravi Subramanian called it a substantial improvement but wants production revocation samples and the approver list export. Findings two and four stay open, and he has one question on the sub-processor list.
Commercial: Theo said Jordan Pike is working back from 4 Dec 2026. Ravi replied that his review concludes when findings close, not when a date arrives.
Watch: Six actions are owed, including break-glass usage and signed weekly reviews. The approver list needs the platform team lead's confirmation, and the residency statement is still a draft.
Themes
Current to 9 Oct 26Theme
Security review, access evidence
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher to send the sample of production revocations, break-glass usage record, completed reviews and draft residency statement before the next session.
- Theo Gallagher to confirm the approver list with the platform team lead before attaching the export.
- Tobias Renwick to write the per-role statement of who can see production data.
Risks
Current to 9 Oct 26- The 4 Dec 2026 working date moves with Ravi's review and may slip if evidence arrives late.
- Finding two stays open until signed reviews and the break-glass usage answer are supplied.
- The data residency statement is still only a draft, so finding four cannot close.
Opportunities
Current to 9 Oct 26- Ravi's requests are specific and deliverable, so findings can close once production evidence is sent.
Transcript
Theo Gallagher NoneHello Ravi, can you hear me all right? I've got you on the recording indicator, so I think we're live.
Ravi Subramanian NoneYes, I can hear you. Good morning from Atlanta, though I imagine it's well into the afternoon for you.- Theo Gallagher NoneIt's just gone four, yes. Raining, naturally. How's your side? Bit warmer, I'd guess.
- Ravi Subramanian NoneHumid. It has been humid since June and I have stopped expecting that to change. Is Tobias joining?
- Theo Gallagher NoneHe is, he's just finishing something. Ah, here he is.
Tobias Renwick NoneApologies, I was at the end of another call and it ran over. Good afternoon, Ravi. Good to see you again.- Ravi Subramanian NoneAnd you. Shall we go straight in? I have a limited window and I would like to use it on the findings.
- Theo Gallagher NonePlease. I'll list where we are so we're all reading from the same page. For the record this is session two, 1 Sep 2026. There are four open findings from session one. Finding one is standing engineer access to customer environments, owner Tobias. Finding two is the post-incident actions, also Tobias. Finding three is the sub-processor list, which is mine, and I sent the updated version last week. Finding four is the data residency statement, also mine, and that one is drafted but I would not call it final.
- Ravi Subramanian NoneThank you. That matches my own list. I would like to take finding one first, because the others depend on it. My question is the same as in session one. Who has standing access?
- Tobias Renwick NoneRight. Before I answer, may I ask what your security team will need to see from this session? I would rather show you the thing that closes the finding than talk around it.
- Ravi Subramanian NoneEvidence. Not a description of the process, the process itself operating. A request, an approval, a grant, an expiry and a log entry for each, tied together.
- Tobias Renwick NoneGood, that is exactly what I have prepared. To be precise, the answer to your question is that no engineer at BB-Demo holds standing access to a customer environment. Our product runs inside the customer's own Snowflake account, so the access we are talking about is a role the customer's account grants us, and the point of the change is that the role does not exist for any individual until it is requested.
- Ravi Subramanian NoneAnd before the change? I want that stated plainly in the record.
- Tobias Renwick NoneBefore the change there was a support role that a small group of engineers held continuously. That was the finding, and you were right to raise it. The honest answer is that it was convenient and it was wider than it needed to be.
- Ravi Subramanian NoneMm. Thank you for saying so directly. Please go on.
- Tobias Renwick NoneI'm going to share my screen. Give me a moment. Can you see a terminal and a browser window?
- Ravi Subramanian NoneI can see both. The text is small. Could you enlarge the browser?
- Tobias Renwick NoneBetter? Good. This is a real request from our test tenant, not a mock-up, and I'll say which parts are test and which are the production mechanism. The mechanism is identical. An engineer opens a request that names the environment, the reason and a ticket reference. They cannot submit without all three.
- Theo Gallagher NoneAnd the control reference for that is the access management policy, section on privileged requests. We can evidence that the reason field is mandatory, you'll see it fail in a second if Tobias leaves it blank.
- Tobias Renwick NoneYes, let me do that. Blank reason, submit. There. Rejected at the form, and the rejection itself is logged. Now with a reason.
- Ravi Subramanian NoneWho approves it? The requester's manager?
- Tobias Renwick NoneNot the manager. A named approver who is not the requester and not in the requester's reporting line, and for a customer environment that approval is also visible to the customer's own administrator. The trade-off is that it is slower than a standing role. We decided that was acceptable.
- Ravi Subramanian NonePlease evidence that the requester cannot approve their own request. Not that the policy says so. That the system refuses.
- Tobias Renwick NoneFair. I'm going to log in as the requester and try to approve. Okay, that is the approval button, and it is greyed out. If I force it through the interface directly, which I'm doing now, I get an authorisation error, and there it is in the audit trail with my own identity against it.
- Ravi Subramanian NoneGood. Continue.
- Tobias Renwick NoneNow as the approver. I approve, with a window. The window is set per request, and there is a ceiling of one working day that nobody can exceed without raising a new request. On approval the system creates a time-bound grant. Nothing is added to the engineer's identity permanently. The grant simply carries an end time.
- Ravi Subramanian NoneWho has standing access to the approval function itself? That is the part I always ask next.
- Tobias Renwick NoneA very small group, and I'm one of them, which is the reason I would like it reviewed by someone outside my team. I will come to the review in the second action. The list is exported here, and you will notice that the platform team lead is on it. Theo, I'd rather you didn't speak to that one without checking with him.
- Theo Gallagher NoneAgreed. I'll confirm with the platform team lead before I put anything in writing about who is on that list, and I'll attach the export once he has confirmed it.
- Ravi Subramanian NoneI would like that in the minutes. Continue with expiry. A grant that is supposed to expire is only a promise until I see it expire.
- Tobias Renwick NoneUnderstood. I have a grant here that was created earlier today with a short window specifically for this call. Let me refresh. The status is still active. We have a minute or so, so let me show you the log while we wait.
- Tobias Renwick NoneThis is the session log. Every query the engineer ran under the grant is recorded with the grant identifier, so you can walk from a single query back up to the request, the reason and the approver. Nothing runs under the role without the identifier. That is how a reviewer, yours or ours, reconstructs what happened.
- Ravi Subramanian NoneCan an engineer alter or delete those log entries?
- Tobias Renwick NoneNot with the role they are granted. The log is written to a store the engineering role has no write permission on. I can show you the permission set if you would like, and then the expiry should have fired. Refreshing now. Status expired. And here is the revocation event, a little after the end time.
- Ravi Subramanian NoneThe gap between the end time and the revocation. That is how long?
- Tobias Renwick NoneIn this case under a minute. I won't promise a figure beyond what this run shows, because it depends on the scheduler, and I would rather give you the log from several real revocations than a single number. Theo, can you add that to the evidence pack?
- Theo Gallagher NoneYes. I'll export a sample of revocations with their end times and revocation times, so you can read the gap yourself. Dated, and marked as a sample so nobody mistakes it for the full set.
- Ravi Subramanian NoneThat is acceptable. What about emergencies? A production fault at night does not wait for a two-person approval.
- Tobias Renwick NoneThere is a break-glass path, and I would be misleading you if I said it was as tight as the normal path. The trade-off is speed against assurance. It needs two approvers, it grants a narrower role, it alerts our security channel the moment it is used, and every use is reviewed afterwards as if it were an incident. If it were used without a matching fault ticket, that would itself be a finding.
- Ravi Subramanian NoneHow many times has it been used?
- Tobias Renwick NoneI do not have that number in front of me and I am not going to estimate it. I will ask for the usage record and Theo will include it. If the answer is not zero, I would rather you saw each instance.
- Ravi Subramanian NoneGood. Now the second finding. What's your incident history, and what changed because of it?
- Tobias Renwick NoneLet me stop sharing and speak to it directly. The review document from the incident was shared with you after session one, and it is written in the blameless format we use, so it describes what the system allowed rather than who did what. Two actions came out of it, and I'll take them in order.
- Tobias Renwick NoneThe first action is the one you have just watched. We removed the standing support role entirely and moved every engineer to requested, time-bound access. That was not a policy memo, it was a permission change, and the old role no longer exists in the customer templates. The second action is about detection. Previously a grant of elevated access would have been visible only to someone who went looking. Now every grant, every break-glass use and every failed approval attempt raises an alert, and a second person who was not involved reviews the week's grants and signs the review.
- Ravi Subramanian NoneSigns it where? And can I see a signed review? A description of a weekly review is exactly what I would call assurance.
- Theo Gallagher NoneThat's fair, Ravi, and I'd rather be exact about what we have today. We have the review template and the schedule. We have completed reviews from recent weeks, and I can evidence those. What I cannot do is hand you a long history, because the process is new. I'll send the completed reviews, with the reviewer names redacted down to role, and I'll say clearly how many there are when I send them.
- Ravi Subramanian NoneRedacted to role is acceptable for the first pass. If I need names, I will ask. Next. Was any customer data accessed during the incident?
- Tobias Renwick NoneThe review document answers that in its own words and I would rather you read those than my paraphrase of them, because I do not want to say something here that is looser than what is written there. If the document leaves a question unanswered for you, write it down and we will answer it in the same format.
- Ravi Subramanian NoneUnderstood. I will mark that I have read it and that two of my questions are not answered by it. I'll send them after this call, numbered.
- Theo Gallagher NonePlease do. We'll reply to each by number and attach evidence where there is any, and say so where there is none.
- Ravi Subramanian NoneNow, a different matter. In the first session your team offered a reference customer. I should be clear that I will not accept a reference customer in place of a control.
- Theo Gallagher NoneUnderstood, and I won't offer it as a substitute. The controls stand on their own evidence.
- Ravi Subramanian NoneThank you. And on the timeline. I understand the commercial team is working to a date. I do not discuss price or the commercial side, that sits with your account owner and our procurement. My review concludes when the findings are closed, not when a date arrives.
- Theo Gallagher NoneCompletely fair. For context only, Jordan has been working back from 4 Dec 2026, but that moves with your review, not the other way round. I'll tell Jordan exactly that.
- Ravi Subramanian NoneGood. Let me give you my position on finding one. I have seen the request, the approval, the refusal of self-approval, the grant, the expiry and the log. That is a substantial improvement on session one. I cannot close it today, because I have seen a test tenant and I want the sample of production revocations and the export of the approver list.
- Tobias Renwick NoneThat seems entirely reasonable. I would not want you to close it on the basis of a test tenant either.
- Ravi Subramanian NoneFinding two remains open until I have the signed reviews and the answer on break-glass use. Finding three, I have read the updated sub-processor list. I have one question on it, which I'll put in my numbered list. Finding four, I have not seen a final statement.
- Theo Gallagher NoneNo, and I'd rather not call the draft final. I'll send the draft marked as a draft, with the open points listed, and you can tell me whether the shape is right before we finalise it.
- Ravi Subramanian NoneThat is the correct way to do it. Please also state, in the pack, who at BB-Demo can see the production data of a customer and under what conditions. One sentence per role.
- Tobias Renwick NoneNoted. I will write that myself so that it is precise, and Theo will check it against the access list before it goes out.
- Ravi Subramanian NoneThen I think we have used the session well. Please send the pack before the next one, in a form I can forward to the audit committee without rewriting.
- Theo Gallagher NoneWill do. To summarise the actions so there's no doubt. One, a sample of production revocations with their end and revocation times. Two, the approver list export, once the platform team lead has confirmed it. Three, the break-glass usage record. Four, the completed weekly reviews, redacted to role. Five, the draft residency statement, marked as a draft. Six, Tobias's per-role statement of who can see production data. And we'll answer your numbered questions by number when they arrive.
- Ravi Subramanian NoneThat agrees with my notes. Thank you both. I will send my questions today.
- Tobias Renwick NoneThank you, Ravi. This was a more useful session than the first, I think, and that is largely because you asked for the thing itself. Best of luck with the rest of your day.
- Theo Gallagher NoneThanks, Ravi. Speak soon.
- Ravi Subramanian NoneGoodbye.
Callsmade from