The End-To-End Flow Is The August Worked Example With An Agent Installation As The Twin
Summary
The flow from what an agent can reach to somebody accepting a risk does not need designing — it is the 2 August worked example with an agent installation as the twin, and excess authority plays the role a regulatory provision played there, which is what makes the finding computed rather than asserted. Four corrections follow. A grant is a tree of subgrants, so blast radius is a path through it; and the load-bearing part is the label on each node, because a control bounds a grant only when it is enforced by something the grant does not include — giving boundary, setting and expectation, and placing most current containment in the middle tier. The two scenarios are the two populations and neither dominates: locally the containment is available and unused, hosted it may be excellent and is unverifiable. Grants and mandates are artefacts, so they get signed rather than keyed. And counting acceptances is the one metric that inverts, because it is maximised by making risks easy to accept.
Key concepts
- A control bounds a grant only if the grant does not include it — three tiers, and no vendor-specific claim required
- Blast radius is a path, not an item — containment relationships are what makes the tree worth having
- Neither population dominates — a large grant with a boundary you own, against a small one with a boundary you cannot see
- Declines are the cheapest test — a hundred percent acceptance means the risks are trivial or the process is theatre
Key ideas
- A permission prompt that a flag in a writable file can disable is an expectation wearing a setting's clothes.
- One hosted container measured: root inside, passwordless escalation, and an egress allowlist that root could not defeat.
- Prohibitions are the presentation layer and the allow-list is the enforcement layer, generated from each other and dated.
- Publishing a prepared tree is a dated assessment of somebody else's product, so every node carries its own date and a re-run method.
On this site
Became document 12 of the registry MVP pack, and gives the grant the structure the excess-authority finding had been assuming since C1.