A Diamond Model pivot names an uncontracted peer company as the victim vertex — do you warn them, and on whose authority?

## Why this is not an engineering decision The pivot is done. Two vertices are filled, the edge is dated, and the third vertex resolves to a company you have never spoken to. The temptation is to send an email, because the technical work feels finished and the human part looks like a formality. It is not, and the reasons are all organisational. **You have no relationship.** No contract, no engagement, no agreed channel, no agreed confidentiality. Nothing obliges you to tell them and nothing protects you when you do. A statement to a third party that their systems are implicated carries real exposure if it turns out to be wrong, and in some jurisdictions the exposure is not hypothetical. That alone moves the decision above the engineer. **The claim is thin, and thin in a specific way.** What you hold is: hosts sharing a private key, an edge with `result: unknown`, and an ownership inference from lease records that could be pointing at a tenant who was not there during the window. Every one of those layers is fine to state and none of them is a finding about the other company's estate. The gap between what you can support and what the recipient will hear is the whole risk. **Somebody else pays part of the cost.** Tell them and they will act, and the operator will notice. A self-signed certificate is cheap to regenerate, but the operator has to redeploy it across a staging estate and re-establish whatever depended on it; for a well-resourced actor with time that is an afternoon's annoyance, not a deterrent. The result is that the key stops linking anything, and the pivot disappears — not only for you but for every other organisation that shared it and had not yet followed it. You are spending a common resource to protect one party, and you do not own the resource alone. ## How the decision usually resolves In practice the default is to warn, and the principled reason is that the exposure of an uninvolved third party outranks the analytic convenience of an artefact you were enjoying. The costs above are arguments about *how* and *through whom*, not about whether. **Route it through something with standing.** A national coordination body, a sector body, or an existing trusted channel between the two organisations converts an unsolicited message from strangers into a routine one from an expected sender. It also puts the recipient's questions somewhere they will actually be answered, and it removes most of the exposure that made this a legal decision in the first place. Where no such route exists, a named owner inside your organisation sends it, and legal has seen the wording. **Hand over the artefact, not the verdict.** The right message contains the certificate's public key, the endpoint, the dates, the direction, and an explicit statement that the outcome is unknown and the ownership is inferred. That lets them check their own side, which is the only thing that can actually resolve the question. What must not travel is a conclusion about their estate, and above all not a named actor: attaching a group name is a separate claim you have not made, it will be the only part anyone remembers, and it converts a checkable edge into an argument. **Say what you will and will not do next.** Whether you keep watching the artefact, whether you will tell them if it changes, and whether you expect anything back. Unsolicited warnings that arrive once and then go silent train people to ignore the next one. ## The cases where the default flips It is worth being able to name them, because a principal who only has one answer has not thought about it. - **The persona layer is genuinely weak.** If the endpoint sits in shared, multi-tenant space and your ownership inference is little better than a guess, warning the wrong company is not a small error — you have handed an unrelated organisation an alarming claim about itself. Firm the ownership up first, or route it to the provider rather than the presumed tenant. - **The window is stale.** An edge from months ago, on address space that has since changed hands, may be a statement about somebody who no longer exists at that address. - **A live engagement would be damaged in a way that matters to the same class of victim.** This is the real version of the "burning the pivot" argument, and it is legitimate only when someone senior with the full picture weighs it, on a clock, with a date at which you warn regardless. It is not a licence for indefinite silence, and "we were still working on it" is not a defence anyone accepts afterwards. ## What an interviewer is listening for That you know the decision has an owner and it is not you. That you can separate the strength of the key match from the weakness of the ownership inference when you write the message. That you understand the cost of warning falls partly on third parties who never got a vote. And that you land somewhere — with a default, a route, and a named condition that would change it — rather than describing the tension and stopping.