// GLOSSARY

Transitive Privilege

The rights an identity reaches indirectly through its ability to assume another identity. Examined one by one, no identity looks over-privileged, yet following the assumption chain can reveal far broader effective permissions; if identity A can assume B and B can assume C, A in fact holds all of C's rights. The danger is here: an audit that looks at each identity separately returns a clean result, because no single authority rule is violated; yet the attacker uses identities as a chain, not one at a time. AWS IAM role assumption (assume-role), Azure Entra ID managed identities and GCP service-account impersonation are typical links of this chain. In cloud IAM assessments, transitive privilege is the most overlooked path to privilege escalation and the basic building block of the privilege chain. The assessment therefore targets not individual permissions but the assumption graph that permissions open to one another.