Skip to content
open.securityopen.securityBeta

ISPM Cross-Vendor Snapshot

ispm-crossvendor-v1

Publication pending
A fully synthetic enterprise snapshot of identities, policies, permissions, and activity across eight vendor-shaped systems.
ispm-crossvendor-v1Declared snapshot
8 synthetic enterprise systems connected through one shared security world.
Systems
8
Tasks
127
Interface
SQLite snapshot

Osbench Labs, frozen.

One synthetic workforce spread across 8 vendor-shaped systems. Nothing in the schema says which records belong to the same person, which is the work every cross-vendor task in ISPM-Enterprise-SQL@v1 actually asks for.

World map

The systems do not declare cross-vendor foreign keys. Agents have to infer identity edges from emails, usernames, names, and platform IDs.

BambooHR
workforce source of record1 table · workEmail · displayName · employee id
Okta
identity provider and application control plane12 tables · login · email · user id
Azure AD
cloud directory and administrative roles4 tables · user principal name · mail · principal id
AWS
IAM, Identity Center, and workload access13 tables · user name · ARN · external id · display name
Google Workspace
directory, admin controls, and document ownership8 tables · primary email · user id · owner email
GitHub
source control membership and activity3 tables · login · email · author login
GCP
project authorization1 table · principal email · project
MongoDB Atlas
database users and administrative teams3 tables · username · user id · project id

One synthetic workforce supplies the latent identity shared by every system above.

Inside the schema.

8 systems · 45 tables

BambooHRworkforce source of record · 1 table
bamboohr_employee
Employment status, department, title, hire, and termination dates.
Oktaidentity provider and application control plane · 12 tables
okta_user
Directory identity and lifecycle state.
okta_factor
Enrolled authentication factors.
okta_group
Directory groups.
okta_group_membership
User-to-group membership edges.
okta_app
Applications and sign-on mode.
okta_app_assignment
Group-to-application assignments.
okta_signon_policy
Session and reauthentication controls.
okta_mfa_policy
MFA policy configuration.
okta_authenticator
Authenticator strength and status.
okta_password_policy
Password composition requirements.
okta_idp
Federated identity-provider configuration.
okta_user_role_assignment
Administrative role grants.
Azure ADcloud directory and administrative roles · 4 tables
azuread_user
Directory users and account state.
azuread_directory_role
Directory role definitions.
azuread_directory_role_assignment
Principal-to-role assignments.
azuread_user_registration_details_report
Registered MFA methods.
AWSIAM, Identity Center, and workload access · 13 tables
aws_iam_user
IAM users and attached policy metadata.
aws_iam_access_key
Access-key status, age, and use.
aws_iam_group
IAM groups and policies.
aws_iam_group_membership
IAM user-to-group edges.
aws_iam_role
Roles and trust policies.
aws_iam_policy
Managed policies and attachment counts.
aws_iam_account_password_policy
Account password controls.
aws_iam_credential_report
Credential and MFA posture.
aws_iam_mfa_device
Assigned MFA devices.
aws_ec2_instance
Instances and attached instance profiles.
aws_identitystore_user
Identity Center users.
aws_identitystore_group
Identity Center groups.
aws_identitystore_group_membership
Identity Center membership edges.
Google Workspacedirectory, admin controls, and document ownership · 8 tables
googleworkspace_user
Users, admin state, MFA, and recovery settings.
googleworkspace_role
Workspace role definitions.
googleworkspace_role_assignment
User-to-role assignments.
googleworkspace_org_unit
Organizational-unit security controls.
googleworkspace_domain
Domain and third-party application policy.
googleworkspace_sso_profile
SSO verification configuration.
googleworkspace_shared_drive_file
Shared-drive ownership and permissions.
googleworkspace_private_drive_file
Personal-drive ownership and permissions.
GitHubsource control membership and activity · 3 tables
github_organization_member
Organization role and 2FA posture.
github_repository_collaborator
Repository permissions.
github_commit
Authorship and activity timestamps.
GCPproject authorization · 1 table
gcp_iam_policy
Project IAM bindings and roles.
MongoDB Atlasdatabase users and administrative teams · 3 tables
mongodbatlas_database_user
Database users and project roles.
mongodbatlas_team
Administrative teams and members.
mongodbatlas_organization_user
Organization users and administrative roles.
Published dataset snapshot and evaluation status
SnapshotActive workforceRoleEvaluation status
default69only published comparison snapshotOfficial

The ground-truth boundary.

During a run the agent receives the task prompt, the SQLite world and the schema documentation. It does not receive the answers. Per-task ground truth is published for auditing and is withheld from the agent workspace for the whole run, and the witness SQL that derives it is not published at all.

Public does not mean injected into the run. That boundary is what makes a score mean anything: a result produced against a world where ground truth was reachable is not comparable with an official run, which is why the visibility below is stated per file rather than summarised.

manifest.toml
publicDataset name, synthetic-world description, and 2026-07-01 publish date.
dataset.db
public + agentThe 45-table SQLite world staged for SQL benchmark runs.
ground_truth.yaml
public · withheld from agent at run timePer-task answers derived from the world; never staged into the agent workspace.
README.md
publicDataset card, synthetic-data notice, profile, and usage notes.

Provenance, and what this snapshot does not guarantee.

Every identity, organization, credential, and activity record is synthetic.

The bundled manifest names ispm-crossvendor-v1 and records a 2026-07-01 publish date.

The snapshot spans eight vendor-shaped systems and 45 SQLite tables; 69 of its 77 workforce records are active.

The current manifest carries no content digest or rebuild seed. Official runs bind the dataset name, so byte-level pinning remains a published limitation.

What runs against it.

Public files pending · ispm-crossvendor-v1

The snapshot ships inside the OSB release and is staged by the harness for a local run. No public download URL is configured for this site yet, so this page names the files rather than offering them.