Identity graphs and privilege transitions¶

The identity graph maps entities as nodes and access transitions as edges. It is often the structure least constrained by firewalls, since an identity transition crosses network boundaries without friction. Two systems that cannot communicate directly may still be governed by a single account, creating a bridge for anything that controls either side.

Types of identity transitions¶

An identity edge can take several operational forms. A known credential provides the simplest transition. A service ticket requested and cracked offline represents an edge requiring time and computing power. A cloud role assumable from specific accounts, or a token exchangeable for a broader scope, extends access further. A helpdesk resetting a password via a telephone call acts as a human-driven transition. Group membership carrying administrative rights allows self-elevation, while delegation settings let services request tickets for users they never authenticated.

These transitions are directional and rarely symmetrical. A workstation account cannot elevate to the management service above it, but that management service can typically control the workstation.

Permanent, active, and conditional edges¶

Transitions vary by their operational requirements. Permanent edges work consistently from a cold start, including static passwords, certificates, or stored keys. Active edges rely on running processes, such as session memory, Kerberos ticket-granting tickets within their ten-hour window, or access tokens expiring within the hour. Conditional edges depend on contextual factors like device compliance, source IP addresses, time of day, or multifactor authentication checks.

High-density identity nodes¶

Identity graphs tend to concentrate around predictable areas. Administrative tiering models gradually degrade through operational exceptions. Service accounts are widely trusted across systems but rarely monitored. Accounts synchronised across multiple directory services create explicit cross-domain pathways. Anywhere a password reset can be triggered by someone other than the account owner represents a dense transition point.

Positional value and network context¶

An identity transition holds no standalone value without network reachability. An account capable of becoming a domain administrator is useless from a network segment that cannot reach a domain controller, yet invaluable from one that can. What a transition ultimately gives depends on what will be honoured without a fight.