rage.fail

CanEnterOrganization

Source reaches org-level control (management account, org policy admin).

cross_boundary CONTROL nature: derived walkable weight 1 high value

Identity ── CanEnterOrganization ──▸ Organization

Source types

Identity

Target types

Organization

States

ACTIVE CONDITIONAL POTENTIAL BLOCKED UNKNOWN

Derivation

nature	derived

Rules that emit CanEnterOrganization 4

aws-cfn-stacksets-org-enter

cloudformation:CreateStackSet/UpdateStackSet with SERVICE_MANAGED permission model (Organizations integration) deploys to all Org member accounts - equivalent to organization-wide foothold.

awsderived

gcp-ci-dwd-enter-org

A DWD SA with both admin-directory and cloud-platform scopes can act as a super-admin and thereby obtain GCP Organization-level control.

gcpderived

admin-inherits-down-contains

Control of a parent administrative boundary inherits transitively to every descendant boundary and resource via Contains*.

derived

enter-boundary-rollups

Materialize a foothold identity inside a subscription/project/tenant/organization when a principal can impersonate/assume/federate into an identity homed there; escalate to Controls only when entry implies admin at a top boundary.

derived