This model begins where the access decision leaves off.
Zero Trust governs access; Privilege Disruption governs the authority remaining beyond it.
Access → Privilege → Execution Authority → Action → Impact
Return to the Zero Trust relationship →
Level 1 Identity-to-Authority Lifecycle + GHDR/PD Control Rail Nine stages · three identity types · three lifecycle zones
Stage & GHDR Role
Enroll → Measure · 00–08 · GHDR/PD control rail
Bar length = authority half-life at this stage.
Long-lived · Session · Task · Ephemeral
Human
Users · Roles
Govern access.
Clock — employment & role lifetime
NHI
Workloads · Services · Bots
Govern function.
Clock — workload & credential lifetime
AI / Agentic
Agents · Models · Workflows
Govern execution authority.
Clock — task, action & decision lifetime
Prepare00–04
Reduce what can be converted — know, constrain and minimize the privilege path.
00
Enroll
Account for the identity before it can act.
GHDR · GovernEstablish authority inventory — account for the identity, its owner and the authority paths it can create
Onboarded against an HR record. Identity, roles and admin relationships mapped at creation.
Long-lived
Created by a build or deploy pipeline. Owner, secrets and service dependencies frequently unmapped — the first gap opens here.
Long-lived
Registered with owner, mission, bound tools and declared delegation relationships. No mission, no enrollment.
Long-lived
01
Request
Access is asked for, never assumed.
GHDR · GovernConstrain request — prevent authority from being assumed
Explicit elevation request against a role. Deliberate, infrequent, attributable to an individual.
Long-lived
Explicit workload requirement declared in configuration or infrastructure code. Written once and rarely revisited.
Long-lived
Task- and action-specific authority requested at runtime, at machine speed. Request volume is no longer a human signal.
Session
02
Validate
Is the requested privilege justified?
GHDR · GovernValidate need — test justification before issuance
Role plus business need. Manager approval, joiner-mover-leaver checks and attestation.
Long-lived
Function plus dependency. Does the workload actually need this to run, or did it inherit it?
Long-lived
Intent, context, resource, tool and risk — evaluated every time. Stated intent is not authority.
Session
03
Grant
What is the minimum privilege necessary to create the required execution authority?
GHDR · Govern · LNPBMinimize available leverage — this is where LNPB starts, not where it ends
Least privilege and just-in-time elevation, time-bound where the role and system allow it.
Long-lived
Scoped credential or key with a rotation policy attached at issuance, not retrofitted afterward.
Long-lived
Design target Task → required capability → minimum privilege → declared expiry. Excess issued here makes Execute a much harder gate to hold.
Task
04
Monitor
Identify changing privilege conditions before they are used.
GHDR · HuntObserve authority — locate privilege debt and authority-path exposure while it is still latent
Privileged-session and access changes measured against behavioral baselines tied to a known person.
Session
Credential and configuration drift, plus unexpected system-to-system calls against a known baseline.
Long-lived
Tool, delegation and authority-envelope drift. Reasoning traces and data flow across the span of a single task.
Task
Disrupt05–06
Control conversion and continuation.
Privilege Disruption is operationalized across the lifecycle — and exercised at the Execute → Re-verify boundary.
Identity + Authority Source + Task + Privilege + Delegation + Tool + Resource + Context + Policy → PD Execution Gate → Allow · Reduce · Require approval · Deny
Knowing that an agent holds privilege is not sufficient. PD must know where that authority came from. The agent's decision cannot be its own authorization.
05
Execute
Can intent acquire sufficient authority to become action?
GHDR · Disrupt · ChokepointDeny conversion — is this conversion permitted at all?
Allow · Reduce · Require approval · Deny
Gate the elevation and the action. Privileged session opened for a defined task and closed on completion.
Session
Gate the privileged function. Automated action under a standing credential often has no gate between trigger and effect.
Long-lived
Gate every consequential action. The identity lifecycle recurs within every agentic task — governance becomes recursive at the task level.
↓ Level 3 · Task Authority Lifecycle
Ephemeral
06
Re-verify
Are the conditions that justified this authority still true?
GHDR · Disrupt · Continuation GateInterrupt continuation — may an authorized conversion continue under changed conditions?
Continue · Reduce · Re-authorize · Revoke
Revalidate the elevated session. Recertification, role review and attestation on a calendar cadence.
Long-lived
Revalidate workload and credential context. Rotation and re-scoping on redeployment or dependency shift.
Session
Re-gate on any material change: objective, resource, tool, data sensitivity, risk, environment, delegation, requested action — and authority-source context, so a change upstream cascades downstream.
Ephemeral
Assure07–08
Eliminate what remains and measure whether debt is returning.
07
Revoke
Remove authority the moment its reason ends.
GHDR · RetireEliminate authority — tear down the whole path, not just the token
Token · session · temporary role · credential · delegated permission · child-agent authority · tool authorization · resource access
Should we remove this person's access? Offboarding, role change and entitlement removal — event-driven and human-initiated.
Long-lived
Does this workload still require this credential? Revoke the token, delete the secret, decommission the service. Orphaned NHIs are privilege debt by definition.
Session
Why does this authority still exist after the task that required it has ended? Expire task and delegated authority. Expiration is not a convenience of JIT — it is a security property.
Ephemeral
08
Measure
Is privilege debt accumulating, reducing, or returning?
GHDR · Retire → Measure → GovernMeasure debt · verify LNPB — determine whether authority was retired, whether privilege debt is returning, and what the next Govern cycle must change
Standing and dormant privileged accounts · privilege-debt trend · failed recertifications · revocation completion · authority surviving beyond role need.
Standing
Orphaned identities · unowned or stale secrets · excessive workload paths · retained dependencies · authority surviving rotation or decommissioning.
Standing
Authority-envelope drift · delegation depth and fan-out · residual post-task authority · survival-limit violations · LNPB verification rate.
Standing
Lifecycle zones · relation to GHDR
Prepare, Disrupt and Assure are lifecycle zones describing where Privilege Disruption acts across the authority lifecycle. They are not a competing operating cycle. Govern → Hunt → Disrupt → Retire remains the operational doctrine of record; the zones map onto it. Stage 08 Measure is not a fifth GHDR function—it is the lifecycle feedback stage that closes Retire and informs the next Govern cycle.
Prepare
GHDR — Govern · Hunt
Govern what authority should exist, and hunt for the latent authority paths that already do.
Disrupt
GHDR — Disrupt
Deny conversion, interrupt continuation, contain propagation.
Assure
GHDR — Retire → Measure → Govern
Retire residual authority, then measure whether it returned. Measure produces the evidence Govern acts on.
Level 2 Execution Authority What can this identity do right now?
Where authority lives
The lifecycle governs the identity. Execution authority is what that identity holds at this instant — the leverage through which an actor converts access or intent into operational impact.
Human
Derived from role and typically persistent between uses, though JIT and ephemeral elevation are important exceptions. Durable by default, which makes recertification the primary control.
Should this identity possess this authority?
NHI
Derived from a workload identity, credential, trust relationship, federation, or platform role, and intended to be scoped to a function. It persists as long as its source does — usually longer than intended.
Does this workload still require this authority?
AI / Agentic
Delegated and issued at the gate. Design target Authority should not persist between tasks and should not survive a change in context.
Should this identity possess this authority, for this action, right now?
Level 3 Agentic Task Authority Lifecycle Nested inside stage 05 · runs once per task, not once per identity
Task Authority Lifecycle
The same governing verbs, on a task clock instead of an identity clock. The outer lifecycle stays intact — the task creates a nested authority lifecycle inside it.
01
Request
Agent declares intent to act.
02
Evaluate
Context, policy, risk, target resource.
03 · Privilege Disruption Chokepoint
Gate
Intent is not authority.
Content is not authorization.
Privilege is not permission to execute indefinitely.
Nothing passes without a decision. This is where intelligence is permitted to become consequence.
04
Grant
Minimum authority, just in time.
05
Execute
Action performed inside the granted scope.
06
Re-evaluate
Context changed? Return to the gate.
07
Expire
Authority ends with the task, not the session.
08
Verify
Confirm nothing was left behind.
Level 4 Authority Propagation What other identities can this identity empower to act?
Authority Graph
The authority envelope answers what an identity can do. The authority graph answers what it can cause other identities to do. Levels 1–3 read an identity vertically; this reads authority horizontally, across identities. Privilege Disruption needs both.
The question is not only what this identity can access. It is what other identities this identity can cause to act.
Effective Authority
What I can execute + what I can cause others to execute
Entitlement is no longer an adequate measure of blast radius. Attacker leverage is not human privilege — it is human privilege × reachable execution authority.
Compromised Admin
Sets missions · assigns tools · approves requests · edits authority envelopes · creates agents
↓ Delegation — authority must narrow · every hop attributable, bounded, independently enforceable
Agent D
Cloud administration
Agent E
Service orchestration
↓ Delegation — authority must narrow again · sub-delegation inherits limits, never expands them
Tool A → Production
via Agent A
Agent C → Database
via Agent B
NHI → Workload
via Agent E
↓ PD gate at every hop — execution
Design invariant 01 · Geometry
Delegation must never amplify authority.
EA₃ ⊆ EA₂ ⊆ EA₁ ⊆ H. Authority becomes narrower and shorter-lived as it moves downstream. An envelope that widens at any hop is evidence of privilege debt, policy failure, or an unsafe delegation path.
Design invariant 02 · Survival limit
Derived authority must not outlive its survival limit.
Measurable requirement: derived authority must expire or be revoked within its defined survival limit, and before it can continue consequential execution. Architectural ambition: authority should be revocable at machine speed wherever it can propagate at machine speed. If delegation establishes authority in seconds but revoking the source leaves downstream agents running for hours, that asymmetry is the adversary's working margin.
PD control · Third problem
Contain propagation.
Deny conversion asks whether privilege may become execution authority. Interrupt continuation asks whether it may persist. Contain propagation asks whether it may create or amplify authority elsewhere.
Failure mode · Authority amplification
Privilege debt breaks the containment geometry — authority widens as it propagates, turning agents into authority multipliers.
Excessive human privilege → over-delegation → agent fan-out → parallel execution authority → machine-speed blast-radius expansion
Level 4 control · Cascade re-verify
Authority inherits trust dependencies.
When the authority source loses trust, changes role, has a session revoked, is flagged as compromised, or loses the entitlement that justified the delegation, every grant derived from that identity is reconsidered — agents, sub-agents, delegated credentials, active tasks and tool grants. The downstream identities did not become untrusted. Their authorization basis did. That distinction is why 06 re-verifies on authority-source context, not only user context.
Continue · Reduce · Suspend · Revoke
Defender Intelligence Execution Authority Crosswalk The governance architecture and the exposure knowledge are mutually reinforcing—not interchangeable
What failure looks like before compromise
The matrix defines how execution authority should be governed. The Defender Intelligence EA domain identifies the discrete, evidenced Prologue conditions—pre-contact structural authority conditions—that reveal where that governance is absent, weakened or structurally bypassed. EA codes classify exposures—not controls, attack actions or ATT&CK techniques.
Governance failure: workload or delegated authority can reach more execution surfaces than its mission requires, without an independently enforced boundary.
Governance failure: intent, a trigger or a requested action can acquire execution authority without an independent gate capable of allowing, reducing, requiring approval or denying it.
Governance failure: disproportionate execution authority is concentrated in a secret, key, token, credential or trusted intermediary. A credential is not EA03 merely because it is privileged; its compromise must unlock materially concentrated authority.
Governance failure: instructions, prompts, documents, messages, retrieved data or generated output can become consequential execution without an independently enforced authorization decision. Content is input—not authority.
Governance failure: an authority-bearing dependency survives the remediation action intended to remove it, leaving a usable path for authority to persist or return.
Latent · IoPE exposure exists → Contact actor or input reaches it → Warning · WoPE conversion may be underway → Spent · ATT&CK authority is exercised
GHDR Privilege Disruption Operating Cycle Four functions · one authority architecture
The operating relationship, stated
Privilege Disruption is operationalized through GHDR across the authority lifecycle and authority graph. Its controls act continuously, with a decisive gate at the Execute → Re-verify boundary.
Deny conversion. Interrupt continuation. Contain propagation.
- GovernDefine, bound and minimize the authority that should exist. Establish admissible authority envelopes, delegation limits and survival rules.
- HuntLocate privilege debt, latent authority paths, unsafe delegation, concentrated authority and residual dependencies before conversion.
- DisruptDeny conversion, interrupt continuation and contain propagation when authority can become—or preserve—adversary control.
- RetireRevoke source and derived authority, remove the dependencies that sustain it, and verify the authority graph is clean.
PD question 01 · ConversionCan this privilege become execution authority?
PD question 02 · ContinuationShould this execution authority continue?
PD question 03 · PropagationHow far can this execution authority propagate?
LNPB minimizes.PD denies conversion.Re-verification interrupts.Containment bounds.Revocation retires.
Right Identity.·
Right Authority.·
Right Task.·
Right Time.·
No Privilege Left Behind.
