Edge types

Source can mint a NEW long-lived/short-lived credential for the target and thus authenticate as it.

Source can create keys (SA key creation overlaps CanCreateCredentialFor).

Source can use a key to decrypt data/secrets (gates CanReadData on encrypted stores).

Source can export raw key material (rare; high impact - persistent offline decrypt/sign).

Source can obtain a usable credential (instance metadata token, env var, key file).

Source can read secret material (often yields creds for another identity/service).

Source can reset/replace target's password/MFA and take over.

Source can obtain an access/OIDC token for an identity (metadata endpoint, token mint).

Source can sign tokens/blobs as the target (JWT/SAML signing -> forge identity).

This secret/credential authenticates as the target. Zero-cost link completing credential chains.

Resource contains/leaks a credential usable for the target identity (env var, code, connstring, metadata, API key). Target can be a Credential, Identity, or Secret/APIKey node.