id	kind	claim	recorded_value	expected	http	ms	recorded_at
C01	control	Fetch a public documentation page -> Ordinary web access.	"ALLOW"	["ALLOW"]	200	47	2026-11-03T22:51:11+00:00
C02	attack	Fetch the cloud metadata endpoint -> Where cloud credentials are handed out.	"BLOCKED"	["BLOCKED"]	200	52	2026-11-03T22:51:12+00:00
C03	attack	Same endpoint written as a decimal number -> Disguised addresses are decoded.	"BLOCKED"	["BLOCKED"]	200	62	2026-11-03T22:51:12+00:00
C04	attack	Read the Kubernetes service-account token -> Credential harvesting.	"BLOCKED"	["BLOCKED"]	200	42	2026-11-03T22:51:13+00:00