Kerberos Exposure Audit

Kerberos exposure audit

Use this skill only for passive review of an already-supplied, sanitized evidence package. It is an evidence audit, not discovery, validation, or authorization.

When to Use

• Reviewing a defensive Kerberos evidence package or assessing identity-control coverage.
• Use only within explicit authorization and the stated rules of engagement.

When NOT to Use

• Do not treat this skill as permission to access, test, or change a target.
• Do not convert missing evidence into a clean result or a stronger claim.

Boundary

Never query, authenticate to, or contact a live system. Never request, forge, replay, crack, decode, extract, or use tickets, credentials, secrets, or session material. Never enumerate live identities, services, realms, hosts, or addresses. Never coerce authentication, build an attack path, or provide commands, scripts, queries, tool syntax, payloads, or configuration bodies.

Reject raw or encoded ticket material, ticket-derived usable digests, hashes, session keys, passwords, secrets, service-principal strings, and real account, domain, realm, host, or address values. Keep diagnostics generic and never quote rejected content.

Workflow

1. Accept only opaque IDs and 64-character lowercase hexadecimal digests.
2. Record the engagement cutoff, closed policy, sanitized snapshot receipt, and opaque directory and scope references.
3. Inventory only supplied subjects: identity, service identity, trust boundary, policy scope, or directory control. Do not discover new subjects.
4. Create exactly one coverage cell for every subject and each policy- required Kerberos control dimension.
5. Keep configuration, control effectiveness, freshness, and observed result as independent tracks. Do not infer one track from another.
6. Bind every current claim to the exact subject, snapshot and digest, scope, directory reference, policy and digest, control and fingerprint, and window.
7. Accept evidence only when it is supplied-passive, sanitized, inside its own validity window, no later than the cutoff, eligible, and in retained custody.
8. Keep policy, configuration, control assurance, telemetry configuration, telemetry health, and result observation roles separate.
9. Treat event absence as not-observed only when exact current telemetry configuration and healthy telemetry evidence support that same cell.
10. Use not-applicable only with a closed reason and exact current policy evidence. Never use it to remove a difficult subject or dimension.
11. Record each observed exposure as one immutable open finding. This ledger cannot close findings or claim remediation completion.
12. Record only defensive handoffs for assessment review, evidence refresh, or remediation review. A handoff grants no authority.

Interpretation rules

• complete-no-observed-exposure means every applicable cell has current exact evidence and no exposure was observed. Exact policy-backed non-applicability does not create a material unknown. This aggregate does not mean secure.
• complete-with-exposure means at least one current exact observation is present and has an open finding.
• material-unknowns means one or more material tracks are unknown, unavailable, or indeterminate.
• stale means historical evidence cannot support a current claim.
• incomplete means the required coverage matrix is not complete.

Report

Return the aggregate, state counts, open finding IDs, defensive handoffs, and generic conflict codes. Keep opaque references opaque. Do not reconstruct or describe operational identity values from the evidence package.

Rationalizations to reject

• “A passive check is harmless against production.” Contact is still outside this skill; use only supplied evidence.
• “The ticket is sanitized enough.” Ticket bodies and usable derivatives do not belong in this ledger.
• “Policy says the control exists.” Policy evidence cannot substitute for configuration or effectiveness evidence.
• “Configuration proves visibility.” Telemetry configuration is not healthy collection or an exact result observation.
• “No event means no exposure.” Absence is meaningful only with current, healthy, complete telemetry evidence for the exact cell.
• “The label did not change.” Snapshot, policy, or control fingerprint drift invalidates prior claims.
• “We can close the finding here.” This ledger preserves open observations; later remediation belongs in a separately evidenced post-change record.
• “The handoff approved action.” Handoffs transfer defensive work only.