L1Authentication / role isolation
All roles, tenant boundary, direct URL/API access for forbidden roles, session invalidation, MFA where configured, cross-MLO isolation
- any cross-tenant/unauthorized-data path => FAILED (no CONDITIONAL_GO)
- circuit breaker after 3 failed repair attempts
L2Income Calculator (zero-known-defect gate)
section 17 income types + case dimensions; independent hand-worked oracle; program rule packs; no generic fallback
- zero known unresolved calculation defect required
- any oracle mismatch => FAILED
L3LOS / SharePoint loan lifecycle
canonical loan/borrower folder from stable loan ID; conditions versioning; UWM/ARIVE controlled functional probe; idempotency/retry/out-of-order/partial failure; no invisible condition; no false completed state
- no PROD credential reuse in DEV/STAGE
- reconcile UWM ledger-vs-config contradiction first
L4Microsoft / email reconciliation
mailbox identity + min Graph scope; classification/dedup/threading/attachment; rate-sheet ingestion w/ supersession; MLO daily briefings (06:00/12:00/18:00 TZ-safe, dup-free); Jose backlog governed recovery (>1000 msgs, NO bulk send/delete)
- no automatic client message / hard delete
- PII out of subject lines