Controls
Terminal control edge: source can administer the target boundary/resource (objective attainment).
Identity
── Controls ──▸
AdministrativeBoundary, *
Source types
IdentityTarget types
AdministrativeBoundary*States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | derived |
|---|
Rules that emit Controls 9
Control Tower landing-zone administration is effectively organization administration.
awsderived
A Microsoft Entra Global Administrator can call elevateAccess to gain User Access Administrator at root scope (/), controlling the root management group and thus every subscription in the tenant.
azurederived
Owner at a subscription or resource group controls that boundary (full actions incl. RBAC assignment).
azurederived
Admin over a resource = control of it.
derived
Ability to grant permissions at a boundary scope = control of that boundary.
derived
Control of a parent administrative boundary inherits transitively to every descendant boundary and resource via Contains*.
derived
Ability to assign roles/permissions at a boundary scope lets the principal self-grant full control of that boundary and, by inheritance, its whole subtree.
derived
Materialize a foothold identity inside a subscription/project/tenant/organization when a principal can impersonate/assume/federate into an identity homed there; escalate to Controls only when entry implies admin at a top boundary.
derived
awsexplicit