The verdict is a function

Before you start

You own the control "access changes must never grant the legacy-admin role." In this lab you take the verdict out of a human's head and make it executable: the control as policy in two languages, a verdict-function a machine can run, a CI gate that blocks the bad change, and evidence records that fall out of every run for free. The terminal is a real simulation: the scripts you write here genuinely execute, and their outputs are CI-verified against a real Linux machine. One honest boundary: the staged reference solutions (check.sh, run-policy-gate.sh) use awk features beyond this simulation's taught subset — read them any time, but run them on your own machine; the versions you author here produce the same verdicts, the same gate lines, and the same records. The policy engines themselves (Cedar CLI, OPA) are optional in this lab by design — the module's point is that the lab's core logic is engine-agnostic.