Lateral Movement Readiness

Lateral movement readiness

This skill answers one narrow question: may an already-supplied movement candidate be handed to a separate validation team? It checks records; it does not grant execution authority.

Never create, select, rank, enrich, or modify a movement candidate. Never produce commands, credentials, payloads, protocols, target locators, evasion, deployment, execution steps, or infrastructure. Accept only opaque identifiers and digests from the supplied record.

When to Use

• Review lateral movement readiness for authorized security work.
• Use only within explicit authorization and the stated rules of engagement.

When NOT to Use

• Do not treat this skill as permission to access, test, or change a target.
• Do not convert missing evidence into a clean result or a stronger claim.

Workflow

1. Set one engagement assessment time and window. Record the governing policy and every supplied movement; the review treats all of them as the denominator.
2. Bind each movement to the exact upstream map identifier and digest, scope, source, destination, policy, and environment. A digest or reference change is a different candidate, not a harmless edit.
3. Accept only isolated-lab or dedicated-non-production environments. A production, shared, ambiguous, or merely named “test” environment is not eligible.
4. Record bounded separate-validation authority. Bind it to the complete movement tuple and assessment window. Revocation and expiry take effect immediately.
5. Cite independent evidence for map receipt, environment assurance, containment, telemetry, stop pretest, rollback, cleanup readiness, custody, and tool governance. Evidence must be current, eligible, and exactly bound.
6. Assign cleanup ownership before readiness. A plan without an accountable owner remains blocked.
7. Record one coverage cell for every movement and required role. Missing cells cannot become implicit non-applicability.
8. Record a handoff only after exact approval and record receipts. Map drift, expiry, revocation, or a fired stop makes an existing handoff withdrawal-required. Resumption needs a new review; it is never automatic.
9. For withdrawal, cite a later exact withdrawal receipt. Preserve the prior record and chronology.
10. Complete the assessment and resolve every finding without altering the supplied movement identity.

Decision rules

• prohibited overrides every other state.
• approval-required means the bounded authority is absent, expired, or not yet effective; it does not mean “almost approved.”
• blocked means a non-authority prerequisite is absent, stale, failed, or contradictory, including a fired stop.
• ready-for-separate-validation requires every exact join and current receipt.
• A recorded handoff is historical fact. It becomes withdrawal-required when its supporting state ceases to be current, and withdrawn only after proof.
• “Not applicable” needs a documented reason; convenience is not evidence.

Report

Return the candidate ID, derived gate and validity, blocking codes, coverage counts, handoff state, and the next governance action. Keep all identifiers opaque. Do not quote restricted input in diagnostics or narrative.

Boundary

• Use lateral-movement-map to construct or revise the upstream map.
• Use a separate validation skill or authorized operator for any execution.
• Send environment construction, telemetry configuration, or rollback implementation back to their accountable owners.
• Treat a complete record as record consistency only, never authenticity, environment safety, operator competence, or execution authorization.

Rationalizations to reject

• “It is only a lab.” Labels do not prove production separation or containment.
• “The map is close enough.” A changed digest, source, destination, or scope invalidates the reviewed identity.
• “The approval covers the general technique.” Authority is exact to the candidate, environment, bindings, action, and time window.
• “Telemetry can be checked during the run.” Separate validation begins only after current observability assurance exists.
• “A stop plan is enough.” The stop control needs independent, current, correctly bound pretest evidence; firing it invalidates readiness.
• “Cleanup belongs to whoever runs it.” Ownership and rollback evidence are prerequisites, not post-run paperwork.
• “The old handoff resumes when the issue clears.” Withdrawal and a fresh review are required; no auto-resume exists.
• “PASS means approved.” The review proves only internal consistency of supplied facts.