ISPM Cross-Vendor Snapshot
ispm-crossvendor-v1
Publication pendingispm-crossvendor-v1Declared snapshot
- Systems
- 8
- Tasks
- 127
- Interface
- SQLite snapshot
Osbench Labs, frozen.
One synthetic workforce spread across 8 vendor-shaped systems. Nothing in the schema says which records belong to the same person, which is the work every cross-vendor task in ISPM-Enterprise-SQL@v1 actually asks for.
World map
The systems do not declare cross-vendor foreign keys. Agents have to infer identity edges from emails, usernames, names, and platform IDs.
One synthetic workforce supplies the latent identity shared by every system above.
Inside the schema.
8 systems · 45 tables
BambooHRworkforce source of record · 1 table
- bamboohr_employee
- Employment status, department, title, hire, and termination dates.
Oktaidentity provider and application control plane · 12 tables
- okta_user
- Directory identity and lifecycle state.
- okta_factor
- Enrolled authentication factors.
- okta_group
- Directory groups.
- okta_group_membership
- User-to-group membership edges.
- okta_app
- Applications and sign-on mode.
- okta_app_assignment
- Group-to-application assignments.
- okta_signon_policy
- Session and reauthentication controls.
- okta_mfa_policy
- MFA policy configuration.
- okta_authenticator
- Authenticator strength and status.
- okta_password_policy
- Password composition requirements.
- okta_idp
- Federated identity-provider configuration.
- okta_user_role_assignment
- Administrative role grants.
Azure ADcloud directory and administrative roles · 4 tables
- azuread_user
- Directory users and account state.
- azuread_directory_role
- Directory role definitions.
- azuread_directory_role_assignment
- Principal-to-role assignments.
- azuread_user_registration_details_report
- Registered MFA methods.
AWSIAM, Identity Center, and workload access · 13 tables
- aws_iam_user
- IAM users and attached policy metadata.
- aws_iam_access_key
- Access-key status, age, and use.
- aws_iam_group
- IAM groups and policies.
- aws_iam_group_membership
- IAM user-to-group edges.
- aws_iam_role
- Roles and trust policies.
- aws_iam_policy
- Managed policies and attachment counts.
- aws_iam_account_password_policy
- Account password controls.
- aws_iam_credential_report
- Credential and MFA posture.
- aws_iam_mfa_device
- Assigned MFA devices.
- aws_ec2_instance
- Instances and attached instance profiles.
- aws_identitystore_user
- Identity Center users.
- aws_identitystore_group
- Identity Center groups.
- aws_identitystore_group_membership
- Identity Center membership edges.
Google Workspacedirectory, admin controls, and document ownership · 8 tables
- googleworkspace_user
- Users, admin state, MFA, and recovery settings.
- googleworkspace_role
- Workspace role definitions.
- googleworkspace_role_assignment
- User-to-role assignments.
- googleworkspace_org_unit
- Organizational-unit security controls.
- googleworkspace_domain
- Domain and third-party application policy.
- googleworkspace_sso_profile
- SSO verification configuration.
- googleworkspace_shared_drive_file
- Shared-drive ownership and permissions.
- googleworkspace_private_drive_file
- Personal-drive ownership and permissions.
GitHubsource control membership and activity · 3 tables
- github_organization_member
- Organization role and 2FA posture.
- github_repository_collaborator
- Repository permissions.
- github_commit
- Authorship and activity timestamps.
GCPproject authorization · 1 table
- gcp_iam_policy
- Project IAM bindings and roles.
MongoDB Atlasdatabase users and administrative teams · 3 tables
- mongodbatlas_database_user
- Database users and project roles.
- mongodbatlas_team
- Administrative teams and members.
- mongodbatlas_organization_user
- Organization users and administrative roles.
| Snapshot | Active workforce | Role | Evaluation status |
|---|---|---|---|
| default | 69 | only published comparison snapshot | Official |
The ground-truth boundary.
During a run the agent receives the task prompt, the SQLite world and the schema documentation. It does not receive the answers. Per-task ground truth is published for auditing and is withheld from the agent workspace for the whole run, and the witness SQL that derives it is not published at all.
Public does not mean injected into the run. That boundary is what makes a score mean anything: a result produced against a world where ground truth was reachable is not comparable with an official run, which is why the visibility below is stated per file rather than summarised.
Provenance, and what this snapshot does not guarantee.
Every identity, organization, credential, and activity record is synthetic.
The bundled manifest names ispm-crossvendor-v1 and records a 2026-07-01 publish date.
The snapshot spans eight vendor-shaped systems and 45 SQLite tables; 69 of its 77 workforce records are active.
The current manifest carries no content digest or rebuild seed. Official runs bind the dataset name, so byte-level pinning remains a published limitation.
What runs against it.
Public files pending · ispm-crossvendor-v1
The snapshot ships inside the OSB release and is staged by the harness for a local run. No public download URL is configured for this site yet, so this page names the files rather than offering them.