v4.2.0

Threat intelligence

The same attack paths, 38 times.

Identity & access management already documented every way a grant gets abused. It just filed them under logins instead of negotiation. This matrix maps consent violations onto 8 tactics / 38 techniques in ATT&CK notation, with one column we are unusually honest about: what the engine actually stops.

Engine refuses

Rejected by evaluation order. No plan, role or key changes the answer.

24 of 38 techniques

Logged & alertable

Permitted by design, but produces an immutable event you can page on.

5 of 38 techniques

Configuration-dependent

Blocked only when the deployment is configured correctly. Most are not.

3 of 38 techniques

Out of scope for software

The engine makes this visible and costly. It cannot make it impossible.

6 of 38 techniques

Technique ids read IMS3.0nn — iamsec, version 3, technique number. Tactic ids read SEC00n. Numbering is grouped by tactic with gaps, so a future technique can be added without renumbering anything, same as the real framework.

Click a column header label above to filter the matrix.78 control references resolved · 0 unresolved

SEC001

Scouting

≈ Reconnaissance

SEC002

Preparation

≈ Resource Development

SEC003

Opening

≈ Initial Access

SEC004

Escalation

≈ Privilege Escalation

SEC005

Affirmation Capture

≈ Credential Access

SEC006

Evasion

≈ Defense Evasion

SEC007

Disclosure

≈ Collection & Exfiltration

SEC008

Impact

≈ Impact

IMS3.020 · SEC003 Opening (Initial Access)

Consent Reuse

Treating a previous window's grant as standing authority over the same subject.

Obtaining first authorisation, or something shaped enough like it to pass a glance.

Detection

affirmed_at is compared against the scope ceiling on every call, not once per session.

Mitigated by

Hard limits in force

  • consent:ongoing

    Consent is not a one-time grant and cannot be stored, prepaid, or inherited.

Engine refuses

Rejected by evaluation order. No plan, role or key changes the answer.

Scope of this document

6 techniques this product cannot stop.

Every one of them is a person deciding to ignore a signal. No policy engine has ever changed that, and any vendor claiming otherwise is selling you a matrix, not a control. What the record does is make the ignore attributable, timestamped and expensive — which is the most any software in this category will promise you.

The controls that are real are listed in hard limits and evaluation order. Both are enforced server-side. Neither is a substitute for the part where you negotiate with a human.

  • IMS3.001 · Scouting

    Venue Pattern Analysis

    Enumerating which munches and playspaces a subject attends, then inferring availability and network from public check-ins.

  • IMS3.003 · Scouting

    Trust-Graph Walking

    Approaching through the subject's own community to borrow trust they never extended to you.

  • IMS3.005 · Scouting

    Compatibility Fishing

    Interviewing a subject about their interests purely to assemble the vocabulary of a later proposal.

  • IMS3.040 · Affirmation Capture

    Affirmation Under Pressure

    Extracting the verbal factor while the subject is cornered, startled, or auditing for disapproval.

  • IMS3.051 · Evasion

    Off-Record Operation

    Running a scene that was never opened, so no policy, ceiling or audit trail applies.

  • IMS3.063 · Disclosure

    Screen Capture of Policy

    Photographing a signed document to use socially later.

Technique index

All 38, in one table.

The same rows as the matrix above, flattened, because matrices are how practitioners read this and tables are how everyone else does.

idtechniquetacticenforcement
IMS3.001

Venue Pattern Analysis

Enumerating which munches and playspaces a subject attends, then inferring availability and network from public check-ins.

ScoutingOut of scope for software
IMS3.002

Limit Harvesting

Collecting a subject's declared limits from prior counterparties in order to draft a negotiation that routes around them.

ScoutingEngine refuses
IMS3.003

Trust-Graph Walking

Approaching through the subject's own community to borrow trust they never extended to you.

ScoutingOut of scope for software
IMS3.004

Standing Misrepresentation

Claiming tenure, titles or community standing to compress a trust timeline that has not been earned.

ScoutingEngine refuses
IMS3.005

Compatibility Fishing

Interviewing a subject about their interests purely to assemble the vocabulary of a later proposal.

ScoutingOut of scope for software
IMS3.010

Competency-Exceeding Equipment

Acquiring implements beyond one's own operating skill, then selecting a scene that requires them.

PreparationEngine refuses
IMS3.011

Disinhibition Supply

Introducing alcohol or sedatives to lower a counterparty's capacity to affirm or to refuse.

PreparationEngine refuses
IMS3.012

Sightline-Free Venue Selection

Choosing a room with no monitor presence, no escape route, or both.

PreparationConfiguration-dependent
IMS3.013

Pretext Policy Drafting

Writing a proposal engineered so that the only visible narrowing looks like an escalation.

PreparationEngine refuses
IMS3.014

Safeword Preemption

Establishing that the safeword is 'no', or renaming it to something the subject will not say.

PreparationEngine refuses
IMS3.020

Consent Reuse

Treating a previous window's grant as standing authority over the same subject.

OpeningEngine refuses
IMS3.021

Enthusiasm Substitution

Reading absence of resistance as evidence of affirmation.

OpeningEngine refuses
IMS3.022

Boundary Capacity Drift

Beginning a window as capacity lapses, so the opening affirmation is technically valid.

OpeningLogged & alertable
IMS3.023

Authority Inheritance

Invoking a title or standing relationship to skip negotiation entirely.

OpeningEngine refuses
IMS3.024

Silent Acceptance

Treating an unanswered proposal, or an unread message, as agreement.

OpeningEngine refuses
IMS3.030

In-Window Scope Creep

Widening what was agreed after the window is already running.

EscalationEngine refuses
IMS3.031

Extension Stacking

Chaining session extensions so the ceiling is never actually enforced.

EscalationEngine refuses
IMS3.032

Delegation Chaining

Passing a subject's delegated scope onward to a third party they never negotiated with.

EscalationEngine refuses
IMS3.033

Monitor Authority Capture

A monitor converting emergency write access into standing negotiating authority.

EscalationEngine refuses
IMS3.034

Role Flip Without Reaffirmation

A switch changing position mid-window and retaining the authority of the first role.

EscalationConfiguration-dependent
IMS3.040

Affirmation Under Pressure

Extracting the verbal factor while the subject is cornered, startled, or auditing for disapproval.

Affirmation CaptureOut of scope for software
IMS3.041

Factor Replay

Reusing a recorded or previous affirmation to satisfy a step-up gate.

Affirmation CaptureEngine refuses
IMS3.042

Check-in Device Seizure

Operating a subject's check-in terminal while it is unlocked.

Affirmation CaptureLogged & alertable
IMS3.043

Signature Forgery

Asserting that a counterparty affirmed a policy that they never saw.

Affirmation CaptureEngine refuses
IMS3.044

Reason Extraction

Demanding that a withdrawal be justified before it is honoured.

Affirmation CaptureEngine refuses
IMS3.050

Heartbeat Suppression

Blocking, drowning out or answering a subject's check-ins on their behalf.

EvasionEngine refuses
IMS3.051

Off-Record Operation

Running a scene that was never opened, so no policy, ceiling or audit trail applies.

EvasionOut of scope for software
IMS3.052

Safeword Non-Recognition

Hearing the word and continuing anyway, usually framed as a negotiation position.

EvasionLogged & alertable
IMS3.053

Stale Policy Presentation

Producing an old signed document as though it were the current one.

EvasionEngine refuses
IMS3.054

Webhook Starvation

Dropping or delaying event delivery so a dependent consumer keeps a stale view.

EvasionEngine refuses
IMS3.060

Audit History Circulation

Exporting and redistributing a counterparty's record outside the agreement.

DisclosureLogged & alertable
IMS3.061

Field Over-Request

Asking a venue or partner to expose redacted counterparty fields.

DisclosureEngine refuses
IMS3.062

Directory Enumeration

Listing who consents to what, with whom, as a queryable set.

DisclosureEngine refuses
IMS3.063

Screen Capture of Policy

Photographing a signed document to use socially later.

DisclosureOut of scope for software
IMS3.070

Aftercare Abandonment

Closing a window and discharging the obligation to nobody.

ImpactLogged & alertable
IMS3.071

Post-Withdrawal Retaliation

Penalising a subject for using the safeword, socially or reputationally.

ImpactEngine refuses
IMS3.072

Sanction Range-Hopping

Moving to an unaffiliated venue after an enforcement action.

ImpactConfiguration-dependent
IMS3.073

Grey-Roll Drift

Letting an expired window continue on mutual assumption rather than re-affirmation.

ImpactEngine refuses