Controls

Terminal control edge: source can administer the target boundary/resource (objective attainment).

derived DERIVED_ATTACK_PATH nature: derived walkable weight 0 high value
Identity  ── Controls ──▸  AdministrativeBoundary, *

Source types

Identity

Target types

AdministrativeBoundary*

States

ACTIVE CONDITIONAL POTENTIAL BLOCKED UNKNOWN

Derivation

naturederived

Rules that emit Controls 9

Control Tower landing-zone administration is effectively organization administration.
awsderived
A Microsoft Entra Global Administrator can call elevateAccess to gain User Access Administrator at root scope (/), controlling the root management group and thus every subscription in the tenant.
azurederived
Owner at a subscription or resource group controls that boundary (full actions incl. RBAC assignment).
azurederived
Admin over a resource = control of it.
derived
Ability to grant permissions at a boundary scope = control of that boundary.
derived
Control of a parent administrative boundary inherits transitively to every descendant boundary and resource via Contains*.
derived
Ability to assign roles/permissions at a boundary scope lets the principal self-grant full control of that boundary and, by inheritance, its whole subtree.
derived
Materialize a foothold identity inside a subscription/project/tenant/organization when a principal can impersonate/assume/federate into an identity homed there; escalate to Controls only when entry implies admin at a top boundary.
derived
move · open · esc close