// GLOSSARY

Privilege Chain

A set of authority relationships in cloud identity and permission models that look harmless alone but, when linked, lead to privilege escalation. As the center of gravity of the modern attack surface shifts from the network to identity, critical risk often accumulates not in a single high-severity vulnerability but in the access paths that ordinary permissions form. AWS IAM role assumption (assume-role), Azure Entra ID subscription-level assignments and GCP service accounts' transitive permissions are typical links of this chain. Such a chain cannot be discovered by reading a configuration list; the question is not whether a permission exists but whether it actually grants passage to the next one, and that is tested only with manual validation and a safe proof of concept (PoC). The finding is therefore not a single misconfiguration but an access path the links produce together; the defense, too, targets not a single permission but the chain-breaking control.