OpenGraph Default Priv Escalation Mode

OpenGraph - Default Priv Escalation Mode

This page describes what "default" OpenGraph output emphasizes before you add --include-all.

Table of Contents

• Default Behavior
• Default Dangerous Rule Set
• Collapsed Role Edges

Default Behavior

By default, OpenGraph focuses on high-signal escalation and abuse paths:

• Emits dangerous single-permission rule edges
• Emits dangerous multi-permission rule edges
• Emits collapsed high-signal role edges (ROLE_OWNER, ROLE_EDITOR)
• Trims lower-signal noise that is not part of the dangerous-rule pathing model

This is the fastest mode for operator triage.

Default dangerous-edge definitions come from gcpwn/mappings/og_privilege_escalation_paths.json.

To modify those routes or add your own, see OpenGraph - Add Your Own Content.

Basic Roles (Collapsed High-Signal Output)

For broad built-in roles, default mode prefers collapsed role edges over many individual dangerous edges.

Role	Emitted Edge	Behavior
roles/owner	ROLE_OWNER	Collapses multiple matching dangerous-path edges into one high-signal edge where applicable
roles/editor	ROLE_EDITOR	Collapses multiple matching dangerous-path edges into one high-signal edge where applicable

This keeps default output readable and reduces duplicate path noise.

Example: roles/owner collapse behavior

Assume user:alice@example.com has roles/owner on project:A.

In default mode, OpenGraph prefers a single collapsed edge:

alice@example.com -> HAS_IAM_BINDING -> roles/owner@project:A -> ROLE_OWNER -> target resource

Instead of emitting many separate dangerous edges (for example CAN_IMPERSONATE_SA, CAN_CREATE_SA_KEY, and other matched rule edges) for the same binding-target path.

When this collapse happens, the emitted ROLE_OWNER edge includes collapsed-rule context in edge properties such as:

• dangerous_rule_names
• dangerous_edge_types
• dangerous_rule_descriptions
• collapsed_role_name
• collapsed_role_edge

Single-permission rules

Edge Kind	Permission
CAN_MODIFY_PROJECT_IAM	resourcemanager.projects.setIamPolicy
CAN_MODIFY_FOLDER_IAM	resourcemanager.folders.setIamPolicy
CAN_MODIFY_ORG_IAM	resourcemanager.organizations.setIamPolicy
CAN_MODIFY_SA_IAM	iam.serviceAccounts.setIamPolicy
CAN_MODIFY_COMPUTE_INSTANCE_IAM	compute.instances.setIamPolicy
CAN_MODIFY_ClOUD_RUN_FUNCTION_IAM	cloudfunctions.functions.setIamPolicy
CAN_MODIFY_SECRET_MANAGER_SECRET_IAM	secretmanager.secrets.setIamPolicy
CAN_IMPERSONATE_SA	iam.serviceAccounts.implicitDelegation
CAN_CREATE_SA_ACCESS_TOKEN	iam.serviceAccounts.getAccessToken
CAN_CREATE_SA_KEY	iam.serviceAccountKeys.create
CAN_READ_SECRET_DATA	secretmanager.versions.access

Multi-permission rules

Edge Kind	Summary
RESET_COMPUTE_STARTUP_SA	Startup script rewrite + reset path with actAs chaining
START_COMPUTE_STARTUP_SA	Startup script rewrite + start path with actAs chaining
CREATE_AND_INVOKE_CLOUDFUNCTION_AS_SA	Create/deploy/invoke Cloud Function path chained with actAs on target SA
UPDATE_AND_INVOKE_CLOUDFUNCTION_AS_SA	Update/deploy/invoke Cloud Function path chained with actAs on target SA
CREATE_CLOUDSCHEDULER_JOB_AS_SA	Create Cloud Scheduler job path chained with actAs on target SA

Collapsed Role Edges

Default mode emits collapsed edges for broad basic roles:

• roles/owner -> ROLE_OWNER
• roles/editor -> ROLE_EDITOR

These collapse multiple dangerous matches into a single high-signal edge per path.

If you need denser/raw graph coverage, use OpenGraph - Inheritance & Include-All.