# CHQ-ED-2026-008

- **Artifact ID:** CHQ-ED-2026-008
- **Public record:** https://record.cybersecurityhq.com/evidence/chq-ed-2026-008
- **Machine-record SHA-256:** `baa8bccd2b5d477fb13f01fc09add04569afcd447b81ae051b057d754dd6f689`

## Complete structured record

```json
{
  "id": "CHQ-ED-2026-008",
  "associated_position": "CHQ-P-2026-009 v1.0",
  "relationship": "original",
  "issuance_date": "2026-03-14",
  "evidence_freeze_time": "2026-03-14T00:00:00Z",
  "total_exhibits": 2,
  "docket_status": "LOCKED",
  "docket_version": "1.0",
  "artifact_class": "EVIDENCE_DOCKET",
  "authority_level": "SUPPORTING_RECORD",
  "reliance_status": "CONTEXT_ONLY",
  "temporal_scope": "CONTEMPORANEOUS",
  "update_policy": "APPEND_ONLY",
  "exhibits": [],
  "claims": [
    {
      "claim_id": "C-01",
      "position_section": "",
      "claim_text": "Cloud platforms, SaaS applications, automation systems, and distributed workloads expose capabilities through APIs and authorization policies. Execution authority is determined by identity permissions, not network location or machine control.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "CSA 2026: service principals, secrets, and autonomous agents outnumber human users 100:1; execution authority flows through identity credentials. CrowdStrike 2026: adversaries move across identity, cloud, and virtual environments by exploiting visibility gaps rather than network perimeter weaknesses. Delinea 2026: identity, not networks or endpoints, is the primary control surface for AI-driven risk.",
      "evidence_class": "E2"
    },
    {
      "claim_id": "C-02",
      "position_section": "",
      "claim_text": "Cloud IAM role evaluation, OAuth delegated access, service identities executing automation pipelines, and workload identity authorization share a common execution path: identity credential to authorization decision to API invocation to system execution.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "Drift/Salesforce OAuth chain (Q1 2026): OAuth token compromise authorized SaaS platform actions at the authorization layer, demonstrating execution path. CHQ-SC-2026-001 (Trust Boundary Inversion, RATIFIED): identity as execution gateway confirmed across multiple Q1 vectors. IBM X-Force 2026: identity-based access paths are primary intrusion vector.",
      "evidence_class": "E2"
    },
    {
      "claim_id": "C-03",
      "position_section": "",
      "claim_text": "Security controls operating solely at observation layers describe system state but do not determine whether execution can occur.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "CrowdStrike 2026: 82% of detections malware-free. Adversaries operate through authorized identity paths, making observation-layer detection insufficient. Flashpoint 2026: pivot from technical encryption to identity extortion confirms adversary understanding that execution authority resides in identity layer, not infrastructure layer.",
      "evidence_class": "E2"
    },
    {
      "claim_id": "C-04",
      "position_section": "",
      "claim_text": "Where execution authority is identity-mediated, governance of identity systems is equivalent to governance of system execution. Failures in identity governance propagate directly into system execution capability.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "Saviynt 2026: when an agent acts, it inherits the permissions of its creator, turning every excess privilege into instant exposure. CHQ-SC-2026-002 (Management Plane Concentration, RATIFIED): control surface concentration in identity and access management confirmed. IBM X-Force 2026: CISOs must treat identity hardening as parallel priority to vulnerability patching.",
      "evidence_class": "E2"
    },
    {
      "claim_id": "C-05",
      "position_section": "",
      "claim_text": "Non-human identity proliferation and agentic AI deployment are compounding the governance gap: most organizations cannot inventory their agent identities or the decisions those agents are making.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "Delinea 2026: 56% of organizations report shadow AI incidents monthly. CSA and Oasis Security 2026: 78% have no formal policies for creating or removing AI identities; 92% lack confidence that legacy IAM tools can manage NHI risks. CHQ-SC-2026-004 (Automation Trust Inheritance, PROVISIONAL): first observed March 3, 2026, EMERGING persistence, approaching ratification threshold.",
      "evidence_class": "E2"
    }
  ],
  "signals": [],
  "linked_exhibits": [
    {
      "id": "CHQ-EX-2026-001",
      "title": "Identity as Configuration, Not Evidence",
      "temporal_tag": "HISTORICAL 1995–2022"
    },
    {
      "id": "CHQ-EX-2026-003",
      "title": "Centralized Update Infrastructure as Execution Surface",
      "temporal_tag": "HISTORICAL 2000–2024"
    }
  ],
  "notice": [
    "This docket records claim-to-source mappings for CHQ-P-2026-009 v1.0.",
    "Evidence classification: E2 throughout. This Position makes structural architectural observations, not regulatory claims. No E1 sources are cited because no statutory or regulatory authority governs the architectural condition itself.",
    "CHQ-SC-2026-001, CHQ-SC-2026-002, and CHQ-SC-2026-004 are cited as corroborating structural conditions, not as primary sources. They are observational registrations, not authoritative evidence.",
    "Docket issued under CHQ-D-2026-ESG v1.0. Reliance recognized only when registered under CHQ-R-2026-001."
  ],
  "integrity_statement": [
    "This docket records claim-to-source mappings for CHQ-P-2026-009 v1.0.",
    "Evidence classification: E2 throughout. This Position makes structural architectural observations, not regulatory claims. No E1 sources are cited because no statutory or regulatory authority governs the architectural condition itself.",
    "CHQ-SC-2026-001, CHQ-SC-2026-002, and CHQ-SC-2026-004 are cited as corroborating structural conditions, not as primary sources. They are observational registrations, not authoritative evidence.",
    "Docket issued under CHQ-D-2026-ESG v1.0. Reliance recognized only when registered under CHQ-R-2026-001."
  ],
  "docket_hash": "ee13e89fe1e4a56970bc2f26755966cf30adda82b0d3d0b14b34fa68db47f837",
  "immutability_layers": [
    {
      "layer": "Layer 1",
      "protects": "CHQ-ED-2026-008 Docket Hash",
      "scope": "the evidence record (claim-to-source mapping)"
    },
    {
      "layer": "Layer 2",
      "protects": "CHQ-P-2026-009 v1.0 Position Hash",
      "scope": "the position text"
    }
  ]
}
```