Sensitive areas genuinely deny access at server level.

Expectations and evidence

Required inputs (protocol identifiers)

configuration, http, intent

When it applies

Routes declared private or sensitive.

How to check

Test private routes without a session and verify authentication, authorisation and caching.

Expectation

No sensitive content is delivered to tested anonymous or unauthorized roles, including from cache; list covered routes and roles.

Evidence to retain

A 401/403 response or authentication redirect, with no sensitive content delivered.

Non-applicability

An authorized inventory attests to the absence of private routes.

Limitations

Absence from the index is not proof of confidentiality.

Outcome clarification

C requires all expectations across the declared scope. NC requires evidenced contradiction; otherwise NT. NA requires evidence of non-applicability.

Reference scope

Technical reference; the TSEP acceptance rule remains an editorial proposal.