Every application in this scenario passed its last security audit. The attack did not happen inside any of them. It traversed the edges between them. Run both scenarios to see the difference architecture makes.
Scenario: Meridian Financial47-App SaaS EnvironmentFinancial Services · 200 Employees
47
SaaS Applications in Graph
6
Hops to Crown Jewels
72 hrs
Attacker Dwell Time
2.3M
Customer Records Exposed
BEFORE CRC — Standard SaaS architecture
⚡
External Attacker
Spear-phishing campaign · finance department · credential harvest
Initial Access
🔑
Employee Credentials
sarah.chen@meridian.com · MFA token intercepted via real-time phishing proxy
Credential Compromise
🔐
Okta (Identity Provider)
SSO session established · 42 connected applications now accessible
Lateral Pivot
💬
Slack
#dev-infrastructure · AWS_ACCESS_KEY_ID found · posted 14 months ago · never rotated
Credential Harvest
☁️
AWS (IAM Escalation)
iam:ListRoles executed · AdministratorAccess on svc-reporting assumed
Privilege Escalation
🗄️
RDS · Production Database
SELECT * FROM customers · full table dump initiated via assumed role
Data Exfiltration
■ Crown Jewels Reached — T+71:43
2,314,887 customer records exfiltrated.
SSN · DOB · account numbers · transaction history.
Dwell time: 71 hours 43 minutes.
Detection triggered by anomalous S3 egress.
Each application passed its last security audit.
AFTER CRC — Minimum surface architecture
⚡
External Attacker
Identical spear-phishing campaign · same employee · same technique
Initial Access
🔑
Employee Credentials
sarah.chen@meridian.com · MFA token intercepted
Credential Compromise
🛡️
Boundary Pillar
Single controlled egress · no OAuth graph · no connected SaaS to traverse
Traversal Blocked
■ Traversal Terminated — T+00:01:27
No graph to traverse.
Chandra CU #4471 logged: anomalous auth attempt.
Alert fired 87 seconds after initial access.
Records exposed: 0.
The credential was compromised.
The architecture made it worthless.
Post-incident analysis.
Uncontrolled graph — failure modes
42 OAuth connections created an implicit attack graph that no single team owned
Credential compromise granted access to 42 applications simultaneously via SSO
Slack became an unintentional secrets store — 14-month-old credentials still valid
IAM key had never been rotated; least-privilege policy never enforced
SIEM alert fired on egress anomaly 72 hours after initial access
Each individual system passed audit. The graph did not.
CRC architecture — structural properties
No uncontrolled OAuth sprawl — cross-surface edges are explicit, typed, authority-gated, and observable
Credential compromise is contained by a bounded reachability envelope rather than ambient connectedness
Every workflow transition is a Chandra Commit Unit — the audit record is the gate
Boundary controls formalize permitted external contacts and the authority required to cross them
Anomalous auth attempt detected and logged in 87 seconds
The attack succeeded at step one. It ended at step one.
Defenders still evaluate systems one domain at a time. Adversaries now traverse them as one unified graph. The credential was always the entry point. The architecture is what determines whether it goes anywhere.
Necessary graphs still need containment.
CRC does not require useful systems to become disconnected islands. AletheiaGraph-class workloads may legitimately traverse relationships, reason across evidence, and execute federated queries across governed surfaces. The security question is therefore not simply whether an edge exists. It is what that edge makes reachable under the current principal, operation, authority, and execution plan.
A CRC execution envelope can constrain permitted edge classes, maximum depth, examined edges, reachable nodes, consequence-weighted exposure, participating surfaces, cross-boundary exchanges, transferred data, and remote-state uncertainty. An optimizer may find a cheaper plan only inside that admissible region.
A plan that crosses an impermissible edge is not an expensive plan. It is not a candidate plan.
The audit record is not a receipt for what already happened. It is the gate token for what happens next. In a CRC-compliant deployment, every state transition is a Chandra Commit Unit. There is no transition that is not recorded. There is no path that is not governed.
Minimum surface begins with elimination: remove the applications, services, edges, and network paths that do not need to exist. What remains is not assumed harmless. Necessary traversal is explicit, authority-gated, bounded, measured, and attributable.