You set aside a flaw because it "requires a user to click". What have you just claimed?

## The commitment audit Every time a precondition is used to set a finding aside, an assertion about the world has been made silently. The audit is the habit of writing it down in full, with three parts that the shorthand always omits: 1. **The population.** How many principals could satisfy the precondition. 2. **The actor set.** Who can reach that population and ask. 3. **The window.** How long the flaw remains unfixed. "Requires user interaction" becomes: *I claim that none of the 5,200 people who receive external mail will open an attachment, approve a prompt or follow a link during the 90 days before this ships, even though anyone on the internet who knows an address format can ask each of them to.* Nobody defends that sentence out loud. That is the point of writing it: the dismissal survives only while it stays implicit. ## Why the claim usually fails Three properties make user interaction a weak barrier in most estates: - **The required action is ordinary.** Opening a document, approving an authentication prompt, following a link in a message that looks like the twenty legitimate ones received that morning. A precondition that asks the target to do their job is not much of a precondition. - **The actor set is unbounded.** Anything reachable by mail, chat federation, a support portal or a public contact form can be reached by anyone. Unlike an account or a network segment, you cannot enumerate the people who can attempt it. - **The window is long and the attempts are cheap.** The claim is not that a given attempt fails; it is that every attempt across the whole population and the whole window fails. A precondition satisfied by one success in thousands is satisfied. ## What user interaction genuinely buys you The audit is not an argument that preconditions never matter. A required human step really does change the attack, just not in the direction the dismissal assumed: - **No self-propagation.** A technique that needs a person cannot spread by itself. This is the single most important honest downgrade available: it is the difference between something that touches machines at the speed of a network and something that advances at the speed of people reading messages. - **No timing control.** The attacker cannot choose the moment. That matters for anything time-sensitive, such as a step that has to land inside a maintenance window or before a credential rotates. - **An extra failure point.** The step can simply not happen, which lowers the yield of any single attempt without bounding the total across many. So the correct sentence is "this is not wormable and the attacker does not control timing", which is defensible, rather than "this needs a click, so it is low", which is not. ## The audit generalises to every precondition Run the same three-part rewrite on the others and the pattern holds: - *Needs an account:* I claim no adversary will hold any of the accounts we have issued, including contractor accounts and self-service registrations. - *Needs local execution on a host of this class:* I claim no adversary will run code on that host class, even where running submitted content is what the host is for. - *Needs network adjacency:* I claim no untrusted device sits on that segment, even though the segment's membership is a floor-plan decision made years ago. Most of these are already falsified by facts you can look up in your own estate. That is the value of the exercise: it turns a severity argument, which is an exchange of intuitions, into an estate question, which has an answer. ## Where the claim is legitimately true Preconditions are sometimes genuine barriers, and pretending otherwise is its own failure. On an isolated system with four named operators, no external messaging path and physical access control, "requires a user to click" has a population of four, an actor set that is nearly empty, and a window you control. The claim is true, and setting the finding aside is correct. The audit is how you tell that case apart from the 5,200-mailbox case, and the two look identical in a spreadsheet column that says only "user interaction required". ## Saying it to the peer who ranked by precondition count The useful move in that conversation is not to argue that their ranking is too generous. It is to ask them to read their own ranking out loud in claim form. "Three preconditions, so low" becomes three assertions about populations, actor sets and windows, and at least one of them will be a statement about the estate that somebody in the room can immediately correct. The conversation stops being about how severe things feel and becomes a series of checks, which is the only version of it that converges.