01 / The operating case
What changes in a real workflow?
A remediation agent normally reads alerts. For an approved incident, it temporarily receives permission to isolate one endpoint.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Bind the temporary grant to incident, endpoint, operator, expiry and revocation; remove it when work ends and check it before isolation.
Architecture review / negative test
Make the boundary testable.
Inventory permanent privileges separately from short-lived grants. An organization cannot honestly claim zero standing privilege if a shared server token still permits every downstream write. A temporary permission should identify the incident, principal, target, allowed verb and expiry, with checkout and action use connected in evidence.
03 / Failure and evidence
What goes wrong, and what can be proven?
A privileged service credential remains usable after incident closure because checkout and execution are not linked.
Measure the grant lifetime and each use, including denied attempts after expiration.
04 / Canonical scope
Why this reference stands alone
This page owns operating model and lifecycle; action-level authorization owns per-operation decision semantics.
Primary references