enter-boundary-rollups

Materialize a foothold identity inside a subscription/project/tenant/organization when a principal can impersonate/assume/federate into an identity homed there; escalate to Controls only when entry implies admin at a top boundary.

derived any cloud emits CanEnterSubscriptionCanEnterProjectCanEnterTenantCanEnterOrganizationControls

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} {'acquire': None} {'identity': None}

where

?acquire in [CanImpersonate, CanAssume, CanFederateAs, CanCreateCredentialFor] node_class(?principal) == Identity and node_class(?identity) == Identity home_boundary(?identity) != home_boundary(?principal) # crossing a boundary

emit

source type	`Identity`
source	`?principal`
target	`home_boundary(?identity) (Subscription \| Project \| Tenant \| Organization)`
conditions	`trust_relationship` `iam_permission`
state logic	inherit from the acquisition edge (?acquire): the enter edge is as strong as the CanImpersonate/CanAssume/CanFederateAs/CanCreateCredentialFor that grants the foothold — CONDITIONAL if that is CONDITIONAL(trust_relationship / condition_expression), BLOCKED if it is BLOCKED. Emit the enter edge keyed to the target's home-boundary subtype: Subscription -> CanEnterSubscription, Project -> CanEnterProject, Tenant -> CanEnterTenant, Organization -> CanEnterOrganization. (Account -> CanEnterAccount is already produced by can-control's enter-account-via-assume; do not re-emit it here.) ADDITIONALLY emit Controls(?principal -> boundary) ONLY when the acquired identity is itself an administrator of that top boundary (e.g. it holds Owner/Global Administrator at the tenant, Organization Administrator at a GCP org, or org-management privileges) — entry alone is NOT control.

Narrative

{principal.name} can act as {identity.name}, which is homed in {boundary.name}; {principal.name} thereby obtains a foothold identity inside {boundary.name} and can operate there as {identity.name}.

Raw rule rules/derived/hierarchy-chains.yaml

id: enter-boundary-rollups
emits:
- CanEnterSubscription
- CanEnterProject
- CanEnterTenant
- CanEnterOrganization
- Controls
description: Materialize a foothold identity inside a subscription/project/tenant/organization when a
  principal can impersonate/assume/federate into an identity homed there; escalate to Controls only when
  entry implies admin at a top boundary.
applies_to:
- '*'
match:
- - principal: null
  - acquire: null
  - identity: null
where:
- ?acquire in [CanImpersonate, CanAssume, CanFederateAs, CanCreateCredentialFor]
- node_class(?principal) == Identity and node_class(?identity) == Identity
- 'home_boundary(?identity) != home_boundary(?principal)   # crossing a boundary'
emit:
  source_type: Identity
  source: ?principal
  target: home_boundary(?identity)  (Subscription | Project | Tenant | Organization)
  permissions: []
  conditions:
  - trust_relationship
  - iam_permission
  state_logic: "inherit from the acquisition edge (?acquire): the enter edge is as strong as the CanImpersonate/CanAssume/CanFederateAs/CanCreateCredentialFor\
    \ that grants the foothold \u2014 CONDITIONAL if that is CONDITIONAL(trust_relationship / condition_expression),\
    \ BLOCKED if it is BLOCKED. Emit the enter edge keyed to the target's home-boundary subtype:\n  Subscription\
    \ -> CanEnterSubscription, Project -> CanEnterProject,\n  Tenant -> CanEnterTenant, Organization ->\
    \ CanEnterOrganization.\n(Account -> CanEnterAccount is already produced by can-control's enter-account-via-assume;\
    \ do not re-emit it here.) ADDITIONALLY emit Controls(?principal -> boundary) ONLY when the acquired\
    \ identity is itself an administrator of that top boundary (e.g. it holds Owner/Global Administrator\
    \ at the tenant, Organization Administrator at a GCP org, or org-management privileges) \u2014 entry\
    \ alone is NOT control."
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal ?acquire ?identity (cross-boundary foothold)
  false_positive_note: "Conservative by design. Getting a foothold identity inside a boundary makes the\
    \ principal able to operate there AS THAT IDENTITY \u2014 it does NOT grant the boundary's full privilege.\
    \ Only add the Controls emit when the acquired identity is genuinely an admin of that boundary; a\
    \ low-privileged SA/MI/guest yields ONLY the CanEnter* foothold, whose downstream reach is then whatever\
    \ that identity itself can do (normal traversal), NOT rule-1 subtree descent. Do NOT emit a CanEnter*\
    \ for a same-boundary acquisition (no boundary crossed). Respect trust/condition gates on the acquisition\
    \ edge \u2014 never upgrade. This rule cites, and does not duplicate, can-control's enter-account-via-assume\
    \ (AWS Account case) \u2014 it fills only the subscription/project/tenant/org gaps."
  narrative: '{principal.name} can act as {identity.name}, which is homed in {boundary.name}; {principal.name}
    thereby obtains a foothold identity inside {boundary.name} and can operate there as {identity.name}.'