The prologue is what was already true. The attack story is the adversary spending it. The boundary is what was there when it tried.
Evidence discipline
The band reflects the source, not the stakes
Band describes how strongly the source establishes that a condition exists. Realization describes whether its consumption is documented. They are independent axes and are never collapsed.
No anchor is a valid state. It is counted, not filled in.
Migration note
Evidence family 1
Prologue catalog
Conditions that supplied latent execution authority before the campaign consumed it. Admission is supply-side only: a condition qualifies if, when exploited or consumed, it supplies authority the adversary can acquire, retain or propagate. Controls that withhold authority are in the boundary family, not here.
ID
Band
Realization
Condition
Debt
Plane
Spent by
Evidence family 2
Attack story catalog
Adversary behavior documented by the source, each pointing back to the prologue conditions it spent, with the relationship typed. Records with no source-supported anchor are marked and counted rather than assigned one.
ID
Band
Behavior
PD Q
Tactic
ATT&CK
Anchors
Evidence family 3
Attack story preparation
Cost and uncertainty reduction. Supplies no authority. Never counted as debt.
Authority consequence
Transitions
Each record is one change of authority state, keyed to the transition rather than to a condition, so one condition may appear in several. A denied transition must name the boundary that denied it.
Controls encountered
Boundaries
Controls the campaign actually met, recorded by observed outcome. An absent boundary is recorded, not omitted. Not observed is not the same as absent.
Invariant analysis
The three questions
Case-invariant. Every case answers these.
Authority conversion
Chain
Finding
Against the canonical sequence
Containment
Reference
Correction from an earlier version
Privilege debt
Six categories, always rendered
Every total carries the evidence composition that produced it.
Metric
Standing caveats
Definition
No rate published for this case
Detection posture
Established by the primary source
Not established by the primary source
Case-specific rendering
Privilege planes and plane jumps
Select a plane to see the records that touch it.
Plane jump. A case-specific visualization of execution authority changing domains as the adversary converts one form of inherited authority into another. It is a rendering of execution authority geometry, not a doctrinal entity. A cloud, SaaS, OT or agentic case renders its own geometry against the same invariant spine.
Defender operating cycle
Govern, hunt, disrupt, retire
Each phase names the prologue records it acts on.
Govern the acceptable prologue. Hunt the actual one. Disrupt at the crossing. Retire the debt that wrote it.
Migration audit
Retired and reassigned records
What a migration removed and where it went. Present so that a shrinking catalog is auditable rather than a silent rewrite.