Read the explanation
This explains the saved demonstration, not an actual authorization audit or evidence that an API is secure. A scenario supplies a fixed base risk. Checked tenant, schema, human confirmation and intent controls subtract thirty, twenty, twenty five and ten points respectively. The score is floored at ten. For the source scenario with base eighty five, tenant and schema together yield thirty five. Adding human confirmation yields ten. Bars at five pixels per score point measure one hundred seventy five and fifty pixels. The penalties are additive chosen constants, not measured reductions in exploit probability. The guardrail checkboxes do not enforce tenant isolation in an external service. Their role in this page is to change a scripted diagnostic label and visualization. Actual authorization requires evidence from the real system, which this demonstration does not collect. The mitigation label requires at least one checked guard and a score strictly below fifty. For base ninety with tenant and intent checked, subtracting thirty and ten leaves fifty, so the page still takes its vulnerable branch. Adding schema subtracts twenty and leaves thirty, which takes the mitigated branch. Bars at five pixels per point span two hundred fifty and one hundred fifty pixels. Exactly fifty is not mitigated; this threshold is separate from the score color thresholds above sixty and above thirty. The trace says execution halted or exploit succeeded based on this same score rule, not an observed blocked network request. A low score and green visual therefore cannot prove an actual exploit was stopped. This causal explanation makes the programmed conditions inspectable without presenting them as a real security certification. The run button walks a stored scenario step array using an eight hundred millisecond interval. It appends predetermined messages and changes graph classes, then evaluates the checkbox score at the end. A changed prompt is exported as text but does not trigger language model inference or alter the fixed scenario step definitions. For an illustrative three and five step array, nominal intervals before the final evaluation are four and six: final evaluation occurs on the next interval after the last step. Bars at fifty pixels per interval show two hundred and three hundred pixels. Browser scheduling may delay those timers, so these are nominal code counts, not guaranteed wall times. JSON exports prompt, selected scenario, guard flags and displayed evaluation fields; it omits the trace history. Offline D three initialization fails, while previously registered controls can still exist. Their actual behavior needs independent native verification.