The reachability audit — twelve questions per endpoint
Twelve questions that ask, endpoint by endpoint, whether your system grants on the basis of what reached it rather than who asked.
Why it exists
Reachability is not identity. CVE-2026-9198 is the extreme published version — a login endpoint that, in the vulnerability record's own wording, mints superuser tokens to any network caller. But the shape is rarely that obvious. It usually looks like a service that was correct when only one thing could reach it, and is now reachable by an agent that did not exist when the boundary was drawn. Answer these from the code and the config, not from memory and not from the design document: the gap between the design and the deployment is the thing you are looking for.
What it contains
Twelve questions in four groups — identity, authority, evidence, revocation
A scoring convention where 'nobody could tell me today' counts as a failure
The escalation path most audits miss, because each endpoint is correct on its own
How to read a failing column as an architecture rather than an endpoint
What a failing set does and does not let you conclude
No email required, and nothing is recorded when you download. Use it, adapt it, argue with it — attribution is welcome, not a condition.
The twelve questions
Score each Y (yes, demonstrably), N (no), or ? (nobody could tell me today). A '?' counts as an N — it is not a smaller problem, it is the same problem plus an unknown.
| Group | # | Question | What a failure means |
|---|---|---|---|
| Identity | 1 | Does this endpoint require a credential at all, or does arrival suffice? | The base case. Include endpoints protected only by network position. |
| Identity | 2 | If a credential is required, does it identify a unique principal — or a role, a team, or a shared service account? | A credential four things share does not identify a caller. It identifies a group, and every record afterward will say so. |
| Identity | 3 | Could the calling agent's credential have been obtained by anything else that can reach the network segment? | Static secrets in environment variables, files or images all fail this. So does anything an agent can read and re-present. |
| Identity | 4 | Does the endpoint distinguish an agent acting for itself from an agent acting for a user? | If both arrive as the same principal, the delegation is invisible at enforcement and no downstream record can reconstruct it. |
| Authority | 5 | Is the grant scoped to specific actions, or is it 'authenticated therefore permitted'? | Callers are known and unbounded. |
| Authority | 6 | Does the grant have a stated expiry enforced at this endpoint, not just a token TTL set upstream? | Expiry that is not enforced where the action happens is a description, not a control. |
| Authority | 7 | Can the caller widen its own grant by asking for more, re-authenticating, or invoking a second endpoint that issues a broader credential? | The escalation path most audits miss, because each endpoint is correct on its own. |
| Authority | 8 | Is the grant attenuating — can a caller pass a narrower authority downstream, and does the downstream honor the narrowing? | If authority passes whole or not at all, every hop runs at the widest scope on the chain. |
| Evidence | 9 | Does a call here produce a record naming the principal, the action, and the authority relied on? | You may be well controlled and unable to demonstrate it. |
| Evidence | 10 | Would that record survive the credential being rotated or the account being deleted? | A record that resolves an identity by lookup, rather than recording it, degrades to nothing. |
| Evidence | 11 | Could you answer 'who authorized this?' about a single call from six months ago, using only what is retained today? | Retention sized for debugging rather than for examination. |
| Revocation | 12 | If you revoked this caller's authority right now, what is still in flight that would land anyway? | Go and measure it rather than estimating it. The time-to-safe-state protocol has the method. |
Reading the columns
| Group failing across the estate | What it means |
|---|---|
| Q1–Q4 | The estate has no concept of an agent principal. Everything downstream of that is cosmetic, and this is the only thing worth fixing first. |
| Q5–Q8 | You have identity but not authority. Callers are known and unbounded. |
| Q9–Q11 | You may be well controlled and unable to demonstrate it. Different problem, different fix, and it usually surfaces at the worst possible moment. |
| Q12 | Nobody has measured revocation. Estimating it is how a containment plan becomes a remediation plan that never happens. |
How to use it
- List every endpoint an agent in your estate can call. Include internal ones — especially internal ones, since that is where the assumption lives.
- Answer the twelve questions from the code and the config, not from memory or the design document.
- Score Y, N or ?, and treat every ? as an N.
- Read the columns. One endpoint failing question 7 is a finding about that endpoint; question 7 failing everywhere is an architecture.
- Treat a failing column as a question to answer, not an incident to declare. This tells you a class of grant is being made on the basis of reachability, which is a precondition rather than an exploit.
Built from public standards and general practice. The instruments cited in this artifact are checked against their primary sources on an ongoing basis. Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
Related: the other artifacts · the diagnostic.
Want this applied to your estate?
These artifacts are general by design — and they are the method behind the Agent Estate Review: two to three weeks establishing what is actually running, what each thing is permitted to do, and where you could not evidence it if you were asked next week. You have just read how it works.