docs/reference/iso27001_control_mapping.md: false claim — A.5.3 Segregation of duties: human_approval.required/granted enforces trainer ≠ approver (DOC-D1B06-002) #73

Wave 0 · theme D0-5: Documented controls that are not implemented · highest severity Critical · 1 finding(s) · effort docs fix

Summary

An auditor or deployer treats ForgeLM as the enforcing segregation-of-duties control and adds no IdP-side separation, so self-approval goes unnoticed.

Primary finding

DOC-D1B06-002 — docs/reference/iso27001_control_mapping.md: false claim — A.5.3 Segregation of duties: human_approval.required/granted enforces trainer ≠ approver

severity Critical

Where. docs/reference/iso27001_control_mapping.md:27 (Turkish mirror: docs/reference/iso27001_control_mapping-tr.md:26) · type: false claim

The document says. A.5.3 Segregation of duties: human_approval.required/granted enforces trainer ≠ approver

What the code does. The approve path resolves the approver identity and logs it, but never compares it with the training operator. A run can be approved by the identity that trained it. The SoA (A.5.3) and RTP R-12 say so too: ForgeLM records identities, and checking that they differ is a deployer/IdP control (the threat model also scopes it out).

Code references. forgelm/cli/subcommands/_approve.py:597-621, forgelm/cli/subcommands/_approve.py:121-160, docs/qms/statement_of_applicability.md:32, docs/qms/risk_treatment_plan.md:177

User impact. An auditor or deployer treats ForgeLM as the enforcing segregation-of-duties control and adds no IdP-side separation, so self-approval goes unnoticed.

Proposed correction. Replace with: "human_approval.required/granted records the approver identity (from FORGELM_OPERATOR) so trainer ≠ approver is auditable; ForgeLM does not reject self-approval — enforce disjoint runner/reviewer identities at the IdP."

Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.
• The release note names the contract this fix restores.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}