impersonate-is-escalation
Impersonating a strictly-more-privileged identity is privilege escalation.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
privilege(?identity) > privilege(?principal)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?identity |
| state logic | inherit from CanImpersonate: if the impersonation is CONDITIONAL(key_permission)/POTENTIAL/BLOCKED, the escalation carries the same state and gating condition. Only ACTIVE when the underlying CanImpersonate is ACTIVE. |
Narrative
{principal.name} can escalate to {identity.name} by impersonating it - it can act as {identity.name}, which holds strictly greater privilege.
Raw rule rules/derived/credential-chains.yaml
id: impersonate-is-escalation
emits: CanEscalateTo
description: Impersonating a strictly-more-privileged identity is privilege escalation.
applies_to:
- '*'
match:
- - principal: null
- CanImpersonate
- identity: null
where:
- privilege(?identity) > privilege(?principal)
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?identity
permissions: []
state_logic: 'inherit from CanImpersonate: if the impersonation is CONDITIONAL(key_permission)/POTENTIAL/BLOCKED,
the escalation carries the same state and gating condition. Only ACTIVE when the underlying CanImpersonate
is ACTIVE.'
confidence: min(contributing_confidences)
derived_from:
- ?principal CanImpersonate ?identity
false_positive_note: "Only emit when the target identity is STRICTLY more privileged than the principal;\
\ a lateral, same-privilege impersonation is credential access but not escalation. Privilege comparison\
\ must use the resolved effective privilege of both identities (accounting for group/role membership),\
\ not a static label. Inherits state from the CanImpersonate input \u2014 never upgrade."
narrative: "{principal.name} can escalate to {identity.name} by impersonating it \u2014 it can act as\
\ {identity.name}, which holds strictly greater privilege."