A fleet's upload credential can be narrowed by environment, by holder, or by right - what does each axis bound?

## Three cuts, not one slider The blast radius of a credential is the product of three quantities, and each has its own control: - **How far it reaches** - the set of *systems* that accept it. Narrowed by **environment separation**. - **How many hold it** - the set of *callers* that present it. Narrowed by **per-holder identity**. - **What it may do** - the set of *operations* the destination accepts it for. Narrowed by **right**. Narrowing one does not narrow the others. A fleet with one credential per collector, each able to read, delete and list everything the fleet ever uploaded, has excellent containment and a very wide reach. A fleet with one write-only shared value has the opposite. Both are commonly described as *scoped*. ## What each axis buys and what it costs | axis | bounds | does not bound | typical cost | |---|---|---|---| | Environment | which systems and which data a leak touches | what one holder may do inside an environment | a handful of distinct values, and discipline about which is configured where | | Holder | how many callers stop on withdrawal; who the record names | the reach of any single compromise | one enrolment and one withdrawal per host, forever | | Right | what any holder can do with the value | how many holders there are, or which systems accept it | a change at the destination, and finding out what the fleet actually needs | ## Environment: the cut people assume they have The common failure is not the absence of separation but its partial presence. The same value is configured for a lower-trust environment *and* for production because it was easier, or the production value was copied into a test machine once to reproduce a bug and stayed. The consequence is that every weaker control around the lower-trust environment - looser access, shared machines, data everyone can see - becomes a path into the stronger one. Note what environment scoping does not do: if both values rest in the same configuration repository, one disclosure still yields both. It cuts what a credential reaches, not where its copies rest. ## Holder: the axis that also buys attribution This is the only axis that changes *who the access record can name*, which is why it is the one that matters during an investigation. It is also the most expensive, because the cost is not the cut itself but its operation over years: an identity per host means one enrolment when a host is built and one withdrawal when it is retired, indefinitely. An identity nobody removed when a machine was decommissioned is a holder you no longer track, which is a hole on the axis you paid to close. ## Right: the cheapest cut and the least used Most fleets need far less than they are granted, and the gap is rarely measured. A collector that only ever uploads does not need to read back, to list, or to delete - yet the value it holds usually can, because it was issued with whatever the destination's default grant offered. Narrowing this is the only one of the three cuts that: 1. Changes what the destination accepts rather than what the hosts hold, so **no host is reconfigured**. 2. Can therefore be made in minutes, including in the middle of a live exposure. 3. Removes whole incident classes at once - a value that cannot read cannot exfiltrate, and a value that cannot delete cannot destroy the record of what it did. Be honest about what remains. A write-only credential still has a radius: it can overwrite or poison objects that downstream consumers trust, exhaust quota, and add data that something else will act on. *Narrower* is not *harmless*, and the candidate who says a read-only or write-only value has no blast radius has stopped one step short. ## The order that costs least On an estate you have inherited, cut in the order of price rather than of severity: **right first**, because it is a change at one place and lands today; **environment next**, because it is a small number of distinct values and one careful audit of which is configured where; **holder last**, because it is the one that multiplies operations for the life of the fleet. Where you stop is a judgement, and stopping is legitimate - but say which axes you left at full width, because that is where the next incident arrives.