> ## Documentation Index
> Fetch the complete documentation index at: https://docs.findmydata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# ADR 0012 cdx strategy

# ADR-0012: CDX tenant strategy for this run

**Status:** Accepted · 2026-07-14

## Decision

Deterministic fixtures are the primary validation path for this run; live CDX work
is deferred until the core slice is demonstrably healthy, then attempted only if
session capacity remains. Rationale: the master prompt prioritizes a deep coherent
vertical slice; live tenant setup (app registration, consents, Selected-scope
grants, protected-API enablement) has high latency/uncertainty and none of it
changes the domain logic being proven.

What this run ships regardless of live access:

* `GraphM365Connector` with real endpoint shapes and contract tests over recorded
  synthetic responses.
* `docs/cdx-test-runbook.md`: exact setup steps (app registrations for read vs.
  remediation identities, Graph permissions, Selected-scope grants, FMD-CDX resource
  plan, synthetic file plan, change sequence, cleanup) so a follow-up session can
  execute it directly.
* `docs/permissions-manifest.md`: every Graph permission requested, why, and
  protected/metered/beta caveats (`assignSensitivityLabel`, beta label listing).
* Feature gates: `FMD_CONNECTOR_MODE=mock|graph`, per-capability config validation
  with explicit `blocked` status surfaced in UI/API when prerequisites are absent.

## Consequences

* No fake live integration: UI/STATUS clearly report mock vs. live per capability.
* The change sequence in the MVP plan (add/edit/rename/permission/label/delete/
  restart) is fully exercised against the mock connector's scripted deltas, so the
  same assertions can be re-run against CDX later.