Edge types

Credential/identity authenticates to a service/endpoint (incl. SaaS/DB).

Source can obtain a principal/session inside the target AWS account.

Source reaches org-level control (management account, org policy admin).

Source can gain access within the target GCP project.

Source can gain control-plane access within the target subscription.

Source can obtain a principal in the target Entra tenant (guest, multi-tenant app, B2B).

A credential harvested in one environment authenticates to another (cross-cloud/SaaS).

A trust/resource policy names a principal in another account (feeds CanAssume/CanEnterAccount). Produced by explicit normalization (policy artifact parsing) and by derived rules (cross-account data-resource sharing patterns like S3 bucket policy with foreign principal). Subscription targets cover Azure's account-boundary analog - a cross-subscription trust (e.g. an approved cross-subscription Private Endpoint connection, or cross-subscription VNet peering).

Cross-project IAM binding / SA usage. ServiceAccount targets cover a workload in one project running as (trusting) a service account owned by another project (e.g. a Vertex AI job or Workbench instance with a cross-project runtime SA) - symmetric with ServiceAccount as a source.

B2B/guest/multi-tenant app trust across Entra tenants.

An external/workload identity resolves to a concrete internal principal (guest->member, IdP subject->role, k8s SA->IAM role).

Identity in provider A is trusted to obtain an identity in provider B (OIDC/SAML/WIF). Enables cross-cloud paths.

Target trusts an external/federated/workload principal - inbound cross-boundary access (incl. k8s IRSA/WI federation). Source can be an identity (principal), a resource policy, or a policy document (e.g., B2C trust policy) that declares the trust.