Rubric

Assessment	Points
Explains manager-specific reproducible installation	4
Distinguishes findings from scanner errors	6
Tests and verifies before/after gate	6
Explains least privilege and policy limitations	4
Total for this exercise	20

This exercise has its own 20-point rubric. Local and hosted paths have equal credit. Least privilege is explained in the required worksheet and assessed by the submission question; students need not run GitHub Actions to answer it. Use the three-scenario and application before/after tables for gate evidence. Report-only fallback must identify unexecuted steps and distinguish synthetic scenarios from historical scans.