{
  "model": "MauriSec closed simulation v2026.11",
  "checkedAt": "2026-11-09T14:22:19.442Z",
  "observations": [
    {
      "name": "Default deny plus breite Freigabe bleibt offen",
      "ok": true,
      "observation": {
        "from": "sandbox/debug",
        "to": "payments/api",
        "port": 8443,
        "protocol": "TCP",
        "allowed": true,
        "directions": [
          {
            "direction": "Egress",
            "selected": [],
            "allowing": [],
            "allowed": true
          },
          {
            "direction": "Ingress",
            "selected": [
              "default-deny",
              "legacy-api"
            ],
            "allowing": [
              "legacy-api"
            ],
            "allowed": true
          }
        ]
      }
    },
    {
      "name": "Unerlaubtes Debug-Pod nach Änderung gesperrt",
      "ok": true,
      "observation": {
        "from": "sandbox/debug",
        "to": "payments/api",
        "port": 8443,
        "protocol": "TCP",
        "allowed": false,
        "directions": [
          {
            "direction": "Egress",
            "selected": [],
            "allowing": [],
            "allowed": true
          },
          {
            "direction": "Ingress",
            "selected": [
              "default-deny",
              "front-to-api"
            ],
            "allowing": [],
            "allowed": false
          }
        ]
      }
    },
    {
      "name": "Legitimes Frontend bleibt erlaubt",
      "ok": true,
      "observation": {
        "from": "edge/front",
        "to": "payments/api",
        "port": 8443,
        "protocol": "TCP",
        "allowed": true,
        "directions": [
          {
            "direction": "Egress",
            "selected": [],
            "allowing": [],
            "allowed": true
          },
          {
            "direction": "Ingress",
            "selected": [
              "default-deny",
              "front-to-api"
            ],
            "allowing": [
              "front-to-api"
            ],
            "allowed": true
          }
        ]
      }
    },
    {
      "name": "Falsches Edge-Pod bleibt gesperrt",
      "ok": true,
      "observation": {
        "from": "edge/metrics",
        "to": "payments/api",
        "port": 8443,
        "protocol": "TCP",
        "allowed": false,
        "directions": [
          {
            "direction": "Egress",
            "selected": [],
            "allowing": [],
            "allowed": true
          },
          {
            "direction": "Ingress",
            "selected": [
              "default-deny",
              "front-to-api"
            ],
            "allowing": [],
            "allowed": false
          }
        ]
      }
    }
  ],
  "before": [
    {
      "apiVersion": "networking.k8s.io/v1",
      "kind": "NetworkPolicy",
      "metadata": {
        "name": "default-deny",
        "namespace": "payments"
      },
      "spec": {
        "podSelector": {},
        "policyTypes": [
          "Ingress",
          "Egress"
        ],
        "ingress": [],
        "egress": []
      }
    },
    {
      "apiVersion": "networking.k8s.io/v1",
      "kind": "NetworkPolicy",
      "metadata": {
        "name": "legacy-api",
        "namespace": "payments"
      },
      "spec": {
        "podSelector": {
          "matchLabels": {
            "app": "api"
          }
        },
        "policyTypes": [
          "Ingress"
        ],
        "ingress": [
          {}
        ]
      }
    }
  ],
  "after": [
    {
      "apiVersion": "networking.k8s.io/v1",
      "kind": "NetworkPolicy",
      "metadata": {
        "name": "default-deny",
        "namespace": "payments"
      },
      "spec": {
        "podSelector": {},
        "policyTypes": [
          "Ingress",
          "Egress"
        ],
        "ingress": [],
        "egress": []
      }
    },
    {
      "apiVersion": "networking.k8s.io/v1",
      "kind": "NetworkPolicy",
      "metadata": {
        "name": "front-to-api",
        "namespace": "payments"
      },
      "spec": {
        "podSelector": {
          "matchLabels": {
            "app": "api"
          }
        },
        "policyTypes": [
          "Ingress"
        ],
        "ingress": [
          {
            "from": [
              {
                "namespaceSelector": {
                  "matchLabels": {
                    "zone": "edge"
                  }
                },
                "podSelector": {
                  "matchLabels": {
                    "app": "web"
                  }
                }
              }
            ],
            "ports": [
              {
                "port": 8443
              }
            ]
          }
        ]
      }
    }
  ]
}