Edge types

Source can add a principal (itself) to a group/role and inherit its permissions.

Source can obtain the target identity's credentials/session (role assumption).

Domain-wide/OAuth delegation to act for other principals.

External/workload identity is trusted to federate into a CSP identity (OIDC/SAML/Workload Identity).

Source can assign a role/permission to a principal (incl. itself) - privilege escalation primitive.

Source acts as target without holding long-lived creds (GCP SA impersonation, act-on-behalf-of).

Source can alter an identity/resource policy to grant itself/others more access. Produced both by explicit normalization (IAM/RBAC setPolicy grants) and by derived rules (deny-policy/org-policy modify capabilities that unlock gated edges).

Source can rewrite who may assume/impersonate the target - self-grant assumption.

Source may attach/pass the target identity to a NEW or existing workload (prereq for CanExecuteAs).

Membership removal - mostly destructive/persistence, not escalation; not walked by default.

EFFECTIVE permission (post evaluation) of an action on a target. Produced by the permission engine / effective-permission evaluator.

A policy artifact is attached to a principal/resource. Feeds the permission evaluator; not walked directly.

Principal is directly granted a role (Entra role, GCP role binding, IAM role attachment).

Source inherits the target's permissions via membership.