Concept · 6 min read
Evaluating Identity Permissions and Blast Radius
Effective access is what an identity can actually do once policies, boundaries and trust relationships are combined. That is the real blast radius.
Granted versus effective access
Policies attached to an identity are only part of the picture. Permission boundaries, resource policies, organization guardrails, and role-assumption chains all shape what an identity can effectively do.
Evaluate the combination. A narrow role that can assume a broad role is, in practice, a broad role.
Measuring blast radius
Blast radius is the set of sensitive resources and actions an identity could reach if compromised. Express it concretely: which buckets, which databases, which secrets, which deployment capabilities.
Compare that set to what the workload uses. The gap between needed and granted access is your most actionable reduction target.
Service identities deserve extra scrutiny
Workload and CI identities are often created quickly, rarely reviewed, and attached to internet-facing code. They are a frequent pivot in real paths.
Usage data (last-used timestamps, access logs) helps scope permissions safely, but absence of evidence in a short window is not proof that a permission is unused.
Discuss this with the Zarketo team
Bring a workflow you want to improve and we'll walk through how connected context applies.
Book a Demo