Pattern 02 · Reachability as authorization
It could reach it, so it did.
Nobody decided the agent should have access to that system. Nobody decided it should not, either. The network path existed, nothing was recorded about what the agent was permitted to touch, and connectivity quietly became the access policy.
The blast radius is discovered, not defined.
An agent operating outside its intended boundary — through a flaw, a misconfiguration, or simply an unexpected task — reaches systems belonging to another team, another environment, or another organization entirely. Afterward, the question "what was it allowed to reach" turns out to have no recorded answer.
No inventory of permitted reach
There is a list of what exists, somewhere. There is rarely a list of what this specific caller was supposed to be able to use.
No chokepoint to ask
Even where the intent was understood, there was no single place in the path that could act on it while the call was happening.
Scope established after the fact
The extent is reconstructed from logs across several systems, under time pressure, while deciding who to notify.
Unknown was treated as permitted.
In most estates, a system nobody has cataloged is not blocked — it is simply ungoverned. The absence of a rule reads as permission, which is exactly backwards for a caller that explores.
Network segmentation helps and is worth doing, but it draws boundaries around places rather than around callers. An agent with a legitimate reason to be inside a segment can reach everything in it.
Make unknown mean denied.
An unknown server has nothing to allow
Calls travel through a governed edge. A server absent from the catalog has no resource to evaluate a policy against, so the call is refused. Being uncataloged stops being a way through.
Environment is enforceable
A rule can deny a caller running in a test or evaluation environment from reaching production resources, even where the network path exists. Connectivity stops being the deciding factor.
Provenance travels with the call
Which agent, which application, which model, which environment — carried on the request and recorded with the decision. "What was this, exactly" is answered on the first pass rather than reconstructed later.
Callers appear from traffic
An agent nobody registered still identifies itself when it connects, so it shows up as an observed actor. The set of things calling your systems stops depending on people remembering to declare them.
The shift is small to describe and large in effect: the question moves from can it get there to is it allowed to, and the second question has an answer that was written down in advance.
Where this control ends.
- We are not a containment control. We do not find the vulnerability that let an agent escape its sandbox, and we are not a substitute for isolation, patching or hardening.
- We are not a detection system. Recognizing an intrusion in progress from security telemetry is a different job, and a necessary one. We evaluate before forwarding; detection looks across everything afterward. Both matter.
- We govern calls that pass through the edge. Traffic that reaches a system by another route is outside what we can decide on.
If you cannot list what your agents can reach.
Most organizations cannot, and finding out is usually the first useful step rather than the last.