01 / The operating case
What changes in a real workflow?
A security team runs a remediation agent. The service owner operates the runtime, an incident commander authorizes containment, the platform team owns policy, and a cloud executor can isolate a host. Without clear ownership, a stale incident grant can persist after handoff.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Define accountable owners for agent inventory, task creation, grant issuance, policy versioning, emergency override, runtime enforcement, revocation and post-action evidence. Separate approver from executor for high-impact actions and make handoff rules explicit.
03 / Failure and evidence
What goes wrong, and what can be proven?
The runtime team assumes the security team will revoke grants while security assumes the runtime expires them; an orphaned agent keeps using a valid credential after the incident closes.
Retain owner assignments, grant issuance and closure events, approval records, policy changes, operator overrides, decisions and outcome reviews with consistent task identifiers.
04 / Canonical scope
Why this reference stands alone
An authority graph is a technical relationship model. This page owns human and team accountability for each relationship and for its lifecycle.
Decision analysis
Assign the revocation handoff
The operating model should answer the ownership question before an incident occurs. A technical grant chain alone cannot decide who may issue, close or override it.
- Incident commander
- Authorizes containment objective and closes the incident.
- Platform policy owner
- Defines target and approval constraints, then versions policy.
- Runtime owner
- Maintains enforcement and revocation propagation.
- Executor owner
- Protects the cloud API and records attempted effect.
- Reviewer
- Reconciles actual host state and exceptional overrides.
Negative test
Close the incident while the agent runtime is partitioned from the grant service. Identify which owner raises the revocation event, which owner ensures the executor rejects a stale request, and which owner detects any escaped action.
Primary references