ACCOUNT ACTIVITY REVIEW BETA - CSV SCHEMA AND EVENT GUIDE

Schema version: svertok.account-activity-review.csv.v0.1
Rules version: svertok.account-activity-review.rules.v0.1

BOUNDARIES

- Use fictional data, or properly anonymized and minimized records you are authorized to review.
- Do not include passwords, session tokens, cookies, recovery secrets, payment-card numbers,
  identity documents, Social Security numbers, email contents, or other sensitive identifiers.
- The tool does not automatically anonymize arbitrary files.
- Maximum file size: 2 MiB. Maximum nonempty data rows: 10,000.
- Inputs, notes, and results stay in the open browser page and are not persisted by the tool.

REQUIRED COLUMNS

event_id
  Stable source event reference. Duplicate and conflicting IDs remain visible and are flagged.

occurred_at
  ISO 8601 event time with Z or an explicit numeric UTC offset. Zone-less and impossible times fail.

account_id
  Stable pseudonymous account reference. Reviews and rule sequences are isolated by this field.

event_type
  One accepted event type listed below. Unsupported types stay visible but cannot trigger a rule.

OPTIONAL COLUMNS

outcome
  Source-supplied result such as allowed, denied, or completed.

device_ref
  Stable pseudonymous device reference. Never place a cookie or token in this field.

session_ref
  Stable pseudonymous session reference. Never place a bearer or session token in this field.

network_ref
  Synthetic or pseudonymous network reference. The tool performs no lookup.

authentication_method
  Source-supplied method such as password or passkey.

location_label
  Coarse source-supplied label. The tool makes no travel or ownership inference from it.

known_device
  true, false, or empty. Empty means unknown, never false.

sensitive_action_type
  Pseudonymous action label such as email_change.

ACCEPTED EVENT TYPES

sign_in_success
  The source records a successful sign-in. It does not establish who signed in.

sign_in_failure
  The source records a failed sign-in attempt.

mfa_success
  The source records a successful multi-factor authentication step.

mfa_failure
  The source records a failed multi-factor authentication step.

password_reset
  The source records a password reset.

recovery_method_change
  The source records a recovery-method change.

session_created
  The source records session creation.

session_revoked
  The source records revocation. session_ref is needed for the related sequence check.

sensitive_action
  The source records a sensitive account action.

INTERPRETATION LIMITS

- Timestamps are ordered in UTC while the original value is preserved.
- Equal instants retain original CSV row order.
- Different accounts are never joined.
- Duplicate or conflicting event IDs remain visible but are excluded from automated sequence checks.
- "New in this file" does not mean new to the account.
- A matched heuristic is a prompt for human review, not proof of account takeover or fraud.
- No matched heuristic does not show that an account is safe.
- Missing observations do not prove safety.