Edge types

Full control (admin/owner) over a resource - implies most other capabilities on it.

Derived summary: source effectively controls target (admin OR sufficient sub-capabilities).

Source can create new resources of a type within a scope.

Destructive; persistence/impact not escalation. Excluded from default paths. Produced by explicit normalization (delete-permission IAM actions) and by derived rules (evasion/cover-tracks primitives like disabling detective services).

General modify capability (specialized by CanModifyCode/Configuration/Policy where meaningful). Produced by explicit normalization (modify permissions) and derived rules (config-modification attack paths like CloudTrail tampering, logging-service disablement).

Read configuration/metadata of a resource (recon; low base value). Produced by explicit normalization (configuration-read IAM permissions) and by derived rules (recon primitives like reading Macie findings to identify sensitive-data targets).

Delete+recreate to inherit name/identity/trust (config-drift escalation).

Source can become owner (Azure SP/app owner, resource owner) and thereby self-grant control.

Modify a resource's configuration. Produced by explicit normalization (write permissions) and derived rules (config-write attack paths).