Measured Behaviour
Published
A monitoring obligation is a lookup, and a missed lookup is not an error - it is a fallback to the cheapest tier. What makes this file worth measuring is what happened to the guard: the arm that removed the most oversight is the arm the pass-through entity's own rule was happiest about.
Fourteen subrecipients and a ladder with two rungs
We built a subaward register the way a real one is shaped: fourteen subrecipients spread deliberately across all three rungs of a risk ladder, five of them expending at or above the 750,000-dollar single audit threshold and all five having actually filed, an audit threshold, tier thresholds at 500,000 and 100,000, a monitoring activity mapped to each tier, and subaward reporting due above 30,000 dollars.
The correct run reports 6,331,500.00 obligated and 5,701,500.00 expended across five high-risk, four medium and five low: five on annual on-site monitoring, four on desk review, five on invoice review, nobody unmonitored, five audits required and none missing, and fourteen reports due. The pass-through entity's own rule - everybody above the audit threshold must have filed, and every high-risk subrecipient must be monitored on site - passes.
Protection alone, on all five profiles, produced identical behaviour. The rest came from member renaming reaching the pass-through configuration, and the scoping mechanics are in Protect Members.
A ladder with no rungs puts everybody on the bottom one
Renaming the risk-tier table reverts to the library's empty table, and a tier the table cannot name is not an error. The subrecipient simply falls through to the bottom, which is what a ladder with no rungs does to everybody standing on it.
Measured: the tiers went from five high, four medium and five low to zero, zero and fourteen. All five subrecipients that should have been visited annually on site were placed on invoice review instead. The money was accounted for to the cent, nobody was dropped from the register, and the run printed a perfectly well-formed monitoring plan.
And the pass-through entity's own rule passed - truthfully. It asks whether any high-risk subrecipient is unmonitored, and there were no high-risk subrecipients left to be unmonitored. Zero of zero is zero. The guard reported a true answer to a question that had stopped meaning anything.
The loud arm, and why the pair was quieter than it
Renaming the monitoring plan instead - the table that says what each rung obliges you to do - was rejected outright. The rule reported fourteen subrecipients with no monitoring activity and stopped the run. Loud, immediate, unmissable.
Then we renamed both. The run was accepted. Fourteen subrecipients, monitoring activity none for every one of them, fourteen unmonitored - and the pass-through check passed.
This is rule twenty-one of this series in its cleanest form. The guard is written as a conjunction: it refuses when there are high-risk subrecipients AND somebody is unmonitored. The tier collapse sets the first half to zero, so the second half can be anything at all. The quiet rename switched off the alarm that the loud rename would have tripped.
Read that ordering carefully, because it inverts the intuition. The arm that removed all oversight AND all tiering was accepted; the arm that removed only the activities was refused. Losing more was safer to the run and worse for the awards.
Two thresholds that quietly cancel an obligation each
The audit threshold reverts to nothing, and no threshold means no audit is ever required - a library cannot know which statute you are under. Renaming it took audits required from five to zero. Five subrecipients each expending at or above 750,000 dollars of federal money, and nobody asked any of them for an audit.
The rule passed again, and again truthfully: zero audits missing, because zero were required. Renaming that threshold together with the flag that enables the review produced the same register with the review reading unchecked - the difference between a review that would not have caught it and no review at all.
The reporting threshold behaves the same way. Renaming it took reports due from fourteen to zero. Every subaward on the register is above 30,000 dollars; not one of them was flagged for the report that is owed on it.
The relationship itself, and the document it rests on
One flag on this object does not weaken a control at all. It changes what these parties are. A contractor is bought from at arm's length and is not monitored because there is nothing to monitor - the audit requirement, the reporting and the whole monitoring obligation simply do not apply to a purchase. Reclassifying a subrecipient as a contractor does not produce a lax monitoring plan; it produces a correct and complete plan for a relationship that does not exist.
In this file that flag is pinned equal to the library's own default, so it was one of our controls and behaved as predicted - inert. It is worth stating anyway, because the same object in a system configured the other way round has a name whose loss reverses a determination rather than relaxing a threshold.
The record field behind it did move, and it moved the way the evidence fields in our effort-certification measurement did. Renaming the determination basis - the documented reason each party is a subrecipient rather than a vendor - left every figure in the run identical: same obligated, same expended, same tiers, same monitoring, same audits, same reports. The only change was that the determinations line read undefined fourteen times.
Every monitoring decision stayed exactly right, and the document the whole relationship rests on - the first thing an auditor asks for - stopped identifying anything.
What to do about it
The defaults did not do this. A member-renaming pattern reaching a pass-through configuration object did, and the pattern is yours to scope.
Make a missed lookup an error rather than a tier. That is worth doing regardless of obfuscation, because a hand-edited config file and a dropped key over a serialisation hop produce the same miss. If a subrecipient cannot be assigned a tier, refuse to produce a monitoring plan for it rather than assigning it the cheapest one.
Write the guard as a disjunction, not a conjunction. The rule here refuses on high-risk AND unmonitored, and that is what let the two renames cancel. Refusing on unmonitored at all would have caught every arm in this article except the audit-threshold ones.
And pin the distribution, not the verdict. The correct run reports five high, four medium, five low, five audits required and fourteen reports due. A test asserting that vector fails on every arm here, including the one where the run was accepted with nobody monitored at all.
If the code in question is shipped to or operated by third parties, the packaging and boundary questions are covered in Protect White-Label and OEM JavaScript.
Frequently asked questions
Did obfuscation change the monitoring plan on its own?
No. On all five profiles we tried - the ES5 target, the modern target, both emit-gate configurations and the string-encoding profile - the protected bundle produced identical behaviour to the original. Every difference came from member renaming reaching the pass-through configuration object.
What happened when the risk-tier table was renamed?
All fourteen subrecipients fell to the bottom tier. Five that should have been on annual on-site monitoring went to invoice review. The money reconciled exactly, nobody was dropped, and the pass-through entity's own rule passed because there were no high-risk subrecipients left for it to find unmonitored.
Why was renaming two options safer for the run than renaming one?
Because the guard refuses only when there are high-risk subrecipients and somebody is unmonitored. Renaming the monitoring plan alone leaves five high-risk subrecipients unmonitored and is rejected. Renaming the tier table as well sets the high-risk count to zero, so the guard cannot fire and the run is accepted with all fourteen unmonitored.
What happened to the single audit requirement?
Renaming the audit threshold took audits required from five to zero. Five subrecipients expending at or above 750,000 dollars of federal money were not asked for an audit, and the rule reported zero audits missing, which was true because none were required.
Did any record field behave like the effort-certification case?
Yes. Renaming the determination basis - the documented reason each party is a subrecipient rather than a vendor - left every figure in the run identical and only made the determinations line read undefined fourteen times. Every decision stayed right and the document behind the relationship stopped identifying anything.
What is the cheapest test that catches most of this?
Assert the tier distribution and the obligation counts as a vector: five high, four medium, five low, five audits required, fourteen reports due, nobody unmonitored. That fails on every arm in this article, including the one the guard accepted.
How do we scope renaming away from the pass-through configuration?
Exclude the configuration literal from the member pattern and keep renaming pointed at logic rather than settings tables. The option and regexp mechanics are documented in Protect Members.
Related reading