💻 computer science

Privilege Risk Evolution for Non-Human Identities: A Temporal Fiber Model for Cloud IAM

This paper proposes a novel "Temporal Fiber Model" for cloud IAM that redefines privilege equivalence for non-human identities by combining structural graph fibration with temporal strongly connected component analysis to identify "privilege circuits," thereby enabling the prediction of long-term structural stability through early detection of ratchet-type privilege evolution.

Original authors: Christophe Parisel

Published 2026-06-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Christophe Parisel

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are managing a massive, bustling office building where thousands of employees (and robots) have different levels of access to different rooms. Some have keys to the breakroom, others to the CEO's office, and some to the server vault.

For years, security guards have checked the access list once a day. If a robot is standing in the breakroom at 9:00 AM, the guard marks it as "Low Risk." If it's in the CEO's office at 9:00 AM, it's "High Risk."

The Problem:
This paper argues that this "snapshot" view is dangerous, especially for the robots (called Non-Human Identities or NHIs).

Imagine a robot that usually sits in the breakroom. But, every Tuesday, it secretly gets upgraded to the CEO's office, then downgraded to the server room, and finally back to the breakroom by Friday. If a guard only looks at the robot on Wednesday morning, they see a "Low Risk" breakroom robot. But the robot's true risk is actually "High Risk" because it can and does access the CEO's office regularly.

Current security tools are like that guard: they only see the robot right now. They don't see the pattern of movement.

The Solution: A "Time-Travel" Map

The authors built a new way to look at these robots that combines Space (where they are now) and Time (where they go). They use three main concepts to explain this:

1. The "Fiber" (The Group Photo)

At any single moment, the authors group robots that have the exact same keys.

Analogy: Imagine taking a photo of the office. You group everyone wearing the exact same badge. Even if Robot A and Robot B are in different rooms, if they have the same list of keys, they are in the same "Fiber."
Why it matters: It simplifies the chaos. Instead of tracking 10,000 robots, you track 50 unique "badge groups."

2. The "Lineage" (The Family Tree)

Robots change their badges over time. Sometimes two groups merge (everyone gets the same new keys). Sometimes one group splits (some get upgraded, some don't).

Analogy: Think of a family tree. If two families merge because they all move into the same neighborhood, they become one big family. The authors track these "families" of badge groups. They noticed that these families eventually settle down into a stable pattern, like a river finding its final path to the ocean.

3. The "Privilege Circuit" (The Loop)

This is the most important discovery. Once the authors tracked the "families" over time, they looked for loops.

The Analogy: Imagine a ride at an amusement park.
- The Monolith: The ride is parked. It never moves. (Safe, boring).
- The Oscillator: The ride goes up and down, but you can always go back down the same way you came up. It's a reversible loop. (Manageable risk).
- The Ratchet: This is the danger. The ride goes up a steep hill, but to get back down, you have to go even higher first, or take a long, winding path that passes through dangerous zones. You can't just "undo" the move.

The Big Finding:
The paper found that many robots are stuck in Ratchets. They might look safe right now, but their "permission envelope" (the total set of rooms they can ever reach) includes the most dangerous rooms.

The "Fingerprint" (The Primorial Invariant)

To prove that two robots are doing the exact same dangerous loop, the authors created a mathematical "fingerprint."

Analogy: Imagine two people running on a track. One runs a lap clockwise, the other counter-clockwise. They look different. But if you assign a unique number to every turn they take (based on how steep the hill is), you can multiply those numbers together. If the final number is the same, they are running the exact same track, even if they started at different times.
This allows the system to say, "Hey, these 50 robots are all running the exact same dangerous loop," even if they look different at this exact second.

The "Crystal Ball" (Backtesting)

The authors tested their theory on a real, massive Azure cloud system (like a giant digital office).

The Test: They looked at the robots' history. They asked: "If we had only looked at the first few weeks of data, could we have predicted which robots would end up in a dangerous 'Ratchet' loop?"
The Result: Yes.
- They found that if a robot showed signs of a "Ratchet" loop early on, it was almost guaranteed to stay in that loop forever.
- Zero False Positives: When their system flagged a robot as "Dangerous Ratchet," it was always correct. They never cried wolf.
- They also found that some robots looked like they were merging into big groups, but they were actually just sitting still. The system correctly ignored them.

Summary of the Paper's Claims

Static checks are blind: Looking at permissions at a single moment misses the real risk of robots that cycle through high privileges.
Time matters: Permissions form "circuits" (loops). Some loops are safe (reversible), but some are "Ratchets" (irreversible escalation).
Early detection works: You don't need to wait years to see the danger. If you see the pattern of a "Ratchet" early, you can predict long-term risk with perfect accuracy.
Not all mergers are dangerous: Just because groups of robots merge together doesn't mean they are becoming dangerous. The system can tell the difference between a harmless merger and a dangerous loop.

In short, the paper says: Don't just look at where the robot is standing today. Watch where it walks tomorrow, next week, and next month. If it's walking a one-way path to the top of the mountain, it's a risk, even if it's currently sitting at the bottom.

Technical Summary: Privilege Risk Evolution for Non-Human Identities

1. Problem Statement

Current Cloud Identity and Access Management (IAM) governance relies on point-in-time (snapshot) audits. These audits treat permission equivalence as a static relation: two identities are considered equivalent if they hold identical roles at a specific moment. This approach fails to capture the temporal dynamics of Non-Human Identities (NHIs), such as service principals, which often cycle through permission states.

The paper identifies a critical gap: an NHI currently holding a low-privilege role (e.g., Reader) may have a "permission envelope" that includes high-privilege states (e.g., Owner) reachable through observed operational transitions. If these transitions form a one-way "ratchet" (escalation is easy, de-escalation is difficult or requires passing through higher privileges), the snapshot risk score is a severe underestimation of the actual risk. Existing tools (e.g., AWS Zelkova, Microsoft Entra) verify policy semantics or track changes but do not model the temporal reachability of permission states or the structural equivalence of evolving permission profiles.

2. Methodological Framework

The paper proposes a three-layer framework that decomposes permission equivalence into structural and temporal components, utilizing graph theory to model NHI evolution.

2.1 Structural Equivalence via Fibration

At any snapshot $t$ , the IAM permission graph is compressed using graph fibration (Boldi and Vigna).

Fibers: NHIs are grouped into "fibers" based on identical permission profiles (sets of role assignment pairs).
Invariant: The Weighted Authorization Risk (WAR) is a fiber invariant; all NHIs in the same fiber share the same risk score at that snapshot.
Limitation: Structural equivalence is static and cannot predict future convergence or divergence of permission profiles.

2.2 Lineage Partition

To track evolution, the paper introduces a lineage partition that organizes fiber transitions into stable compartments.

Transitions: Fibers undergo mutations, merges, splits, creations, and dormancy.
Asymmetry: The partition tracks merges (reducing the number of blocks) but absorbs splits (a single fiber splitting into children inherits the parent's lineage block).
Equilibrium: The lineage partition converges to a stable state where blocks no longer merge, providing a persistent ground for temporal analysis.

2.3 Temporal Equivalence via Privilege Circuits

Within a stable lineage, the evolution of fibers is modeled as a fiber transition graph.

Privilege Circuits: Defined as Strongly Connected Components (SCCs) in the transition graph. Two fiber states are temporally equivalent if they are mutually reachable within an SCC.
Permission Envelope: The union of all permission states in a circuit. The risk of any NHI in the circuit is the maximum privilege level within that envelope.
Three-Type Classification:
1. Monolith (M): Single fiber state; static.
2. Oscillator (O): All transitions are reversible (bidirectional edges); bounded cycling.
3. Ratchet (R): Contains at least one irreversible edge (directed escalation); de-escalation may require transient re-escalation. This is the most critical governance risk.

2.4 Topological Fingerprinting (Primorial Invariant)

To compare circuit structures across windows and NHIs, the paper defines a primorial invariant.

Encoding: Elementary cycles are enumerated (Johnson's algorithm). Each edge is assigned a rational factor based on its direction (bidirectional vs. directed) and privilege gradient (up, down, flat), mapped to disjoint prime families.
R-vector: The sorted list of these invariants serves as a unique topological fingerprint, enabling exact matching of circuit structures without graph isomorphism testing.

2.5 Windowed Temporal Methodology

The framework employs multi-scale analysis and stability sweeps:

Multi-scale: Analyzing NHIs across multiple window sizes ( $h$ ) to distinguish true structural ratchets from scale-dependent artifacts.
Stability Sweep: An NHI is deemed "R-stable" if the ratchet pattern recurs across a threshold number of window sizes.
Backtesting: A predictor is tested to see if early observation (at $h_{obs} = K \cdot b$ ) can accurately predict long-term R-stability.

3. Key Contributions

Fibration/Temporal Decomposition: A formal separation of permission equivalence into spatial (fibration) and temporal (SCC-based) components.
Privilege Circuit Classification: A governance-relevant taxonomy (Monolith, Oscillator, Ratchet) based on edge symmetry in the transition graph.
Primorial Invariant: A computable, decodable topological fingerprint for privilege circuits that enables efficient cross-window and cross-NHI comparison.
Lineage Compartmentalization: A method to organize fiber dynamics into stable compartments, making temporal analysis well-defined.
Predictive Methodology: A windowed, multi-scale approach that transforms descriptive analysis into a predictive tool for detecting persistent escalation patterns.

4. Empirical Results

The framework was evaluated on a large Azure tenant with ~31,000 NHIs over ~100 snapshots (approx. 1 year).

Assumption Validation:
- Baseline Independence: 99.2% of non-baseline NHIs converged to baseline fibers, validating that lineage structures are robust to baseline choice.
- Monolith Prevalence: 88.7% of lineage blocks were monolithic, confirming temporal dynamics are confined to a minority of complex lineages.
- Equilibrium: Lineage counts stabilized within 8 snapshots (~2 weeks).
Circuit Detection:
- Lineage LA (Diverse): 132 NHIs showed R-stable privilege circuits recurring across 18 of 21 window sizes.
- Lineage LB (Homogeneous): 5 NHIs shared an identical R-vector, indicating a common operational cause (e.g., shared template).
- Lineage LC (Negative Control): Despite absorbing 7 other lineages, it contained zero privilege circuits, proving that structural consolidation does not imply temporal escalation.
Backtesting (Predictive Power):
- Precision: At base sizes 6 and 7, the early-observation predictor achieved Precision = 1.000 (zero false positives).
- Recall: Improved with observation depth (0.706 at base 5 to 0.812 at base 7).
- Artifact Detection: False positives at base 5 were localized to a single fiber and vanished at coarser scales, demonstrating the method's ability to filter transient noise.

5. Significance and Claims

The paper claims that cloud IAM governance is inherently spatio-temporal. The primary significance lies in exposing persistent escalation patterns (ratchets) that are invisible to point-in-time analysis.

Risk Correction: The "permission envelope" provides the correct risk attribution for NHIs in non-monolith circuits, correcting the systematic underestimation of risk in snapshot audits.
Operational Feasibility: Early detection of ratchet-type circuits is feasible with zero false positives after observing a small number of snapshots (e.g., 21 snapshots at weekly cadence).
Governance Implications:
- Alert Suppression: Transitions in Monolith and Oscillator circuits can be suppressed from monitoring as they represent bounded, reversible dynamics.
- De-escalation Strategy: Durably de-escalating an NHI in a ratchet circuit requires de-escalating the entire circuit, not just the current state.
- Focus on Absorbers: Governance should prioritize "dominant absorber" lineages where permission consolidation is actively occurring.

The authors explicitly state that while the framework detects well-defined graph properties with high precision, the direct correlation between these "structural ratchets" and actual security incidents (e.g., exploitation) remains a conjecture requiring future operational validation. The work reframes cloud governance from a static compliance check to a dynamic, predictive discipline.