An operator buys a valid CI pipeline token, pushes an image the cluster deploys, and reads production data. Which step escalated privilege?

## Read the chain hop by hop The trap in this scenario is the instinct to hunt for the exploit. There is none, and looking for one is the wrong reflex. The right reflex is to ask, at each hop, *who granted this right, and to whom*. **Hop one — push.** The build identity is entitled to write images to the registry. That entitlement is not an accident; a pipeline that cannot publish artefacts is useless. The operator did nothing to obtain the right, only something to obtain a credential that carries it. **Hop two — deploy.** The cluster pulls the referenced image and runs it. This is the deployment's entire purpose. No decision is made about *what* the image contains, because the design placed that decision upstream, in the pipeline the operator now holds. **Hop three — read.** The container runs under a workload identity that was granted access to the production database because the application needs it. The operator's code inherits that access simply by executing inside the workload, with no further authentication step of its own. At no point does an identity acquire rights it did not have. The operator moved *between* identities, each already entitled, and the direction of those moves is not up. ## What the operator actually paid for One credential. That is the whole bill. Compare it with what the operator did *not* have to buy: - No vulnerability research and no exploit, reliable or otherwise. - No race against patching, because there is nothing unpatched in the path. - No custom tooling, because the estate's own delivery mechanism performs every remaining step. - No persistence work in the classical sense, because the route stays open as long as the entitlement does. This is why routes made of granted rights are attractive quite independently of stealth: they are *cheap and reliable*. An exploit chain has a shelf life measured against a vendor's release cycle. An entitlement chain has a shelf life measured against an organisation's willingness to revisit who may deploy what, which is usually much longer. ## The contrast case that makes the point A competent platform engineer, on an ordinary Tuesday, performs this same sequence in this same order: builds, pushes, lets the cluster deploy, and the workload reads the database. The action sequence is not merely similar, it is the same. Nothing intrinsic to the operations separates the intrusion from the deployment. What differs is one fact that lives entirely outside the sequence: whether the party holding the credential was authorised to hold it. That is a statement about custody, not about behaviour, and the whole reason this route is chosen is that it pushes the distinguishing fact out of the actions and into a place the actions never touch. ## Where the framework lands ATT&CK's **T1078, Valid Accounts** covers exactly this. It is worth knowing that ATT&CK lists that single technique under **four** tactics — Initial Access, Persistence, Privilege Escalation and Defense Evasion — because candidates often assume account use is a footnote next to the "real" escalation techniques. The taxonomy says otherwise: using a valid account *is* the escalation, *is* the persistence, and *is* the evasion, all at once. ## The answer the interviewer is testing for The question asks which step escalated privilege, and the correct answer is a confident **none** followed immediately by a refusal to let that stand as reassurance. Say the two things together: 1. There is no escalation in this chain, and looking for one will waste the review. 2. The chain reached production anyway, so "no escalation" tells you about the mechanism and nothing about the outcome. A candidate who says only the first sounds precise and is dangerous. A candidate who says only the second sounds alarmed and imprecise. Both sentences together are the answer. ## What genuinely bounds a route like this The move rests on two preconditions that are not on any host: a **reusable** credential exists for the build identity, and the identities in the chain are entitled to more than the specific job requires. Those are the properties that would have to change, and they live with whoever owns the pipeline and the workload's access — which is also why this kind of route survives estates that have hardened every operating system in them.