2026 04 27 pap dynamic policy profiling proportionality

Policy Administration Point (PAP) dynamic policy profiling and proportionality: mapping asset metadata to a lifecycle-aware Policy Enforcement Point (PEP) topology scaled by inherent risk

Research Question

How can a Policy Administration Point (PAP) dynamically map a governed asset's metadata, specifically its invariants and Confidentiality, Integrity, and Availability (CIA) ratings, to a proportional and lifecycle-aware set of Policy Enforcement Points (PEPs), such that the depth of governance applied scales with the asset's inherent risk profile rather than being applied uniformly?

Scope

In scope:

The computational mechanism by which the PAP reads an asset's declared invariants, for example "handles Personally Identifiable Information (PII)" or "executes financial transactions", and CIA classification
Derivation of a differentiated PEP topology across the four lifecycle phases: Getting Started, Development, Delivery, and Operation
Formalisation of the mapping function from invariant set x CIA rating x lifecycle phase to PEP topology
Conditions under which CIA-High agentic Artificial Intelligence (AI) systems face hard gates at Getting Started and Operation that low-risk utility agents do not
Lattice-based access control theory, especially Bell-LaPadula style partial orders and extensions, as a candidate formalisation framework
Capability-based security theory applied to invariant declarations for deriving minimum required PEP coverage
Policy-Based Access Control (PBAC) literature review scoped to the static versus dynamic topology-selection gap

Out of scope:

Implementation of a specific PAP product or vendor solution
Detailed runtime enforcement mechanics, covered by downstream RQ3
Policy synchronisation across phases, covered by RQ2
Anomaly detection in the Policy Information Point (PIP), covered by RQ4

Constraints:

The mapping function must be defined, not merely described as a desired outcome; formalisation is required
The research must ground the proportionality argument in empirical evidence, not only theoretical assertion, and should use the systems-capability-debt framing where available
This is the foundational Research Question (RQ); all other RQs in this set depend on the invariant registration and PEP topology produced here

Context

[fact; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] Current PBAC practice is already dynamic at authorization time because Attribute-Based Access Control (ABAC) evaluates subject, resource, action, and environment attributes, and eXtensible Access Control Markup Language (XACML) separates policy administration, decision, enforcement, and information roles across the PAP, Policy Decision Point (PDP), PEP, and PIP.
[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] The unresolved design gap is one layer above request evaluation: the reviewed standards define how a request is decided once it reaches a PEP, but they do not define a function that chooses the lifecycle-distributed PEP topology from asset metadata before the first request is made.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Prior completed repository work already showed that agentic AI amplifies overshared permissions, removes human rate limits, and makes workaround estates more dangerous, so topology choice changes both blast radius and delivery cost rather than only documentation quality.

Approach

PBAC literature gap analysis: Survey current PBAC, ABAC, and XACML material to distinguish what is already dynamic at request time from what remains architecturally static at topology-design time.
Lattice formalisation: Model the mapping function as a monotone partial order over invariant set x CIA rating x lifecycle phase to PEP topology, drawing on Bell-LaPadula style lattice theory and Denning-Sandhu ordering ideas.
Capability-based derivation: Treat invariants as capability declarations. Apply capability-based security theory to derive minimum required PEP coverage for each invariant class.
Lifecycle-phase gate specification: For each combination of CIA rating and invariant class, specify the PEP topology at Getting Started, Development, Delivery, and Operation, and define when a phase transition becomes a hard gate.
Empirical grounding: Use adjacent completed items on systems capability debt, access-control amplification, implicit rate limiting, deployment gating, and machine identity to ground why proportionality is necessary in practice.
Synthesis: Produce a formal specification of the mapping function, a worked example for a CIA-High PII-handling transactional agent, and decision criteria for PAP implementors.

Sources

Research Skill Output

(Full output from running the research skill, retained verbatim in the completed item. Sections 0-5 are the investigation, and section 6 seeds the Findings section below.)

§0 Initialise

[fact; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf] Research question restated: what function should a PAP compute so that an asset's invariant set and CIA rating determine a proportional, lifecycle-aware PEP topology, rather than one uniform enforcement pattern for all assets?
[fact; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] Scope confirmed: the investigation covers request-time access-control theory, topology derivation, lifecycle gating, and control proportionality, but it does not design a vendor product or full runtime enforcement implementation.
[fact; source: https://davidamitchell.github.io/Research/research/2026-03-15-context-layers-aligned-decisions-synthesis.html; https://davidamitchell.github.io/Research/research/2026-03-16-adaptive-policy-authorization-compliance.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Prior work cross-reference: prior completed items already established the organisational context hierarchy, the nearest adaptive-policy analogue, the agentic permission-amplification mechanism, the removal of human rate limits, the empirical cost of workaround estates, the need for distinct machine identities, and the Delivery-phase role of deployment gates; this item extends that body of work by specifying the missing PAP-side mapping function.
[fact; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] Output format confirmed: knowledge, specifically a formal mapping rule, a phase-by-phase topology, and a worked example.

§1 Question Decomposition

Root question: how should a PAP convert asset metadata into a lifecycle-aware PEP topology that increases with risk and does not collapse into uniform governance?
A. Existing dynamic-policy baseline
- A1. What do ABAC and XACML make dynamic today?
  - A1.1. Are authorization decisions already dynamic at request time?
  - A1.2. Do the standards specify how many PEPs exist or where they sit across the lifecycle?
B. Formalisation
- B1. Can asset metadata be represented as an ordered risk structure?
  - B1.1. What ordering over invariant sets is defensible?
  - B1.2. What ordering over CIA labels is defensible?
  - B1.3. What monotonicity property must the mapping satisfy?
C. Capability derivation
- C1. Which invariant classes imply additional minimum control coverage?
  - C1.1. Regulated-data handling
  - C1.2. Consequential state change or financial transaction execution
  - C1.3. Privileged or policy-mutating authority
  - C1.4. Autonomous external actuation
D. Lifecycle placement
- D1. Which enforcement surfaces belong to Getting Started?
- D2. Which enforcement surfaces belong to Development?
- D3. Which enforcement surfaces belong to Delivery?
- D4. Which enforcement surfaces belong to Operation?
E. Proportionality
- E1. When should a phase transition be a hard gate rather than a soft gate?
- E2. Why does uniform gating fail for both low-risk utilities and high-risk agents?

§2 Investigation

[fact; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] Source classes: primary sources in this item are NIST publication pages and control extracts, the NIST Risk-Adaptive Access Control (RAdAC) glossary entry, and the OASIS XACML specification; secondary sources are Ravi Sandhu's lattice summary and Miller, Yee, and Shapiro's capability paper; prior completed repository items are internal syntheses used only where they directly qualify the same control surfaces.

2.1 What current ABAC and XACML models already solve

[fact; source: https://csrc.nist.gov/pubs/sp/800/162/final] NIST SP 800-162 defines ABAC as a logical access-control methodology in which authorization is determined by evaluating attributes associated with the subject, object, requested operation, and sometimes environmental conditions against policy, rules, or relationships.
[fact; source: https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] XACML defines the PAP as the system entity that creates policy, the PDP as the system entity that evaluates applicable policy and renders an authorization decision, the PEP as the system entity that performs access control by making decision requests and enforcing authorization decisions, and the PIP as the system entity that acts as a source of attribute values.
[fact; source: https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] XACML also defines a decision request as the request by a PEP to a PDP, treats context as the canonical representation of a decision request and decision, and allows obligations and advice to accompany permit or deny outcomes.
[fact; source: https://csrc.nist.gov/glossary/term/Risk_Adaptive_Adaptable_Access_Control; https://csrc.nist.gov/pubs/sp/800/207/final] RAdAC and Zero Trust Architecture (ZTA) both extend this dynamic-decision logic by incorporating identity, operational need, risk, session assurance, and contextual signals into authorization decisions.
[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://csrc.nist.gov/glossary/term/Risk_Adaptive_Adaptable_Access_Control] The standards therefore already make access decisions dynamic once a request reaches an enforcement point, but they stop short of defining a PAP-side function that decides which enforcement points must exist across the lifecycle for a newly registered asset.
[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] The precise gap is not "PBAC is static" in general; the gap is that the reviewed PBAC and ABAC literature is dynamic about authorization evaluation, yet architecturally under-specified about topology derivation and phase-specific gate selection.

2.2 What the closest adaptive-policy analogue adds, and what it still omits

[fact; source: https://davidamitchell.github.io/Research/research/2026-03-16-adaptive-policy-authorization-compliance.html] The completed Adaptive Policy-Based Authorization (APBA) item found that dynamic privilege management, dynamic account management, dynamic attribute association, and per-request authorization decisions are explicitly supported by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 controls AC-2, AC-3, AC-16, and AC-24.
[fact; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] AC-2 requires account privileges and attributes to be specified and supports dynamic privilege and dynamic account management, AC-3 supports attribute-based access control, AC-16 supports dynamic attribute association and audit, and AC-24 requires access-control decisions to be applied to each request before enforcement.
[inference; source: https://davidamitchell.github.io/Research/research/2026-03-16-adaptive-policy-authorization-compliance.html; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] APBA is therefore the nearest architectural analogue for dynamic policy selection, but it still operates at decision time and does not specify how a PAP should compute a phase-distributed topology from invariants and CIA labels at registration time.

2.3 Lattice and partial-order formalisation

[fact; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] Ravi Sandhu's summary of Denning's axioms defines a security-class set with a partial order and least-upper-bound operator, notes that practice may yield a partially ordered set rather than a complete lattice, and shows that products of lattices remain lattices.
[fact; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] The same source shows Bell-LaPadula and Biba as equivalent one-way information-flow structures under opposite orientations and notes that dynamic labels can remain secure when they move only upward under high-water-mark style rules.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] The best fit for this problem is a partial-order or product-lattice formalism rather than a literal Bell-LaPadula secrecy model, because CIA and invariant classes combine confidentiality, integrity, and operational-hazard properties that are not reducible to one linear secrecy scale.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-risk-tier-classification-controls.html; https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] The repository's risk-tier item also supports highest-triggered-tier rather than averaging logic, which aligns with partial-order joins and makes a union-based treatment of incomparable invariants more defensible than a single scalar score.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] Let R = (I, C) be a risk label where I is the declared invariant set and C is the CIA label. Order risk labels by subset inclusion over invariants plus non-decreasing CIA level. If two assets have incomparable invariants, for example regulated-data handling versus privileged policy mutation, their join is the union of both control requirements rather than an average.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/] A proportional mapping function F(R, phase) -> topology is sound only if it is monotone: whenever one risk label dominates another, the resulting topology must be at least as strong, never weaker, because least privilege and ordered risk become incoherent if higher-risk assets can map to smaller control coverage.

2.4 Capability-based derivation from invariants

[fact; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf] Miller, Yee, and Shapiro argue that pure capability systems have significant advantages over access control list systems because they provide much better support for least-privilege operation and for avoiding confused deputy problems.
[fact; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf] The same paper says capability-based systems provide much stronger support for precise, minimal, and meaningful delegation of authority.
[inference; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/] Declared invariants can therefore be treated as capability demands: an invariant tells the PAP what kind of authority the asset must exercise, and the topology should instantiate the minimum enforcement surfaces needed to keep that authority precise, reviewable, and non-ambient.
[inference; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/] The most useful invariant classes for topology derivation are informational-only, regulated-data, consequential-state-change, privileged-or-policy-mutation, and autonomous-external-actuation, because each class implies a distinct minimum-authority and delegation problem.

2.5 Control-basis for hard and soft gates

[fact; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/] AC-2 requires systems to specify account privileges and attributes, authorize access based on valid authorization and intended system usage, and support dynamic privilege management and dynamic account management.
[fact; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/] AC-3 requires logical-access authorizations to be enforced in accordance with policy and includes mandatory access control, controlled release, application access assertions, and attribute-based access control enhancements.
[fact; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/] AC-6 requires least privilege for users or processes acting on behalf of users and adds separate processing domains, privilege review, privileged-function logging, and prevention of privilege escalation by code.
[fact; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/] AC-16 requires attributes to be associated with information or subjects, retained, audited, reviewed, and dynamically associated where policy requires.
[fact; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] AC-24 requires access-control decisions to be applied to each access request before enforcement and allows decisions based on security or privacy attributes that do not include the acting user's identity.
[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] A hard gate is justified when a lifecycle phase cannot satisfy these control expectations unless the required enforcement surface exists before the phase begins. A soft gate is justified when the phase can proceed with lighter controls, bounded scope, and later strengthening without violating those same control expectations.

2.6 Lifecycle-aware topology synthesis

[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] The minimum PEP basis set for this problem is: G0 registration and classification gate, G1 identity and delegation gate, G2 development sandbox and connector boundary gate, G3 delivery and promotion gate, G4 runtime authorization gate, G5 runtime rate-limit and exception-routing gate, and G6 evidence and stop-authority gate.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] G1 is mandatory whenever an asset is not purely personal or disposable, because the repository's machine-identity work shows that consequential non-human actors need distinct identities and bounded delegation rather than borrowed human sessions.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] G3 is the natural Delivery-phase PEP because the repository's deployment-pipeline item found that release-time control is the enforceable chokepoint for low-code and citizen-built agents once maker access already exists.
[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] G4 is mandatory for any asset with consequential state change, privileged mutation, or high-sensitivity data handling, because the access-amplification item shows that runtime blast radius grows to the worst-case interpretation of granted permissions.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] G5 and G6 become mandatory once human pacing is no longer the primary constraint, because the implicit-rate-limiting item showed that autonomous execution removes the friction that previously bounded throughput and error propagation.
[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] A practical monotone mapping is: low-risk informational utilities map to {G0} in Getting Started, {G2} in Development, {G3} in Delivery, and {G4} in Operation; assets with regulated-data or consequential-state-change invariants add {G1} at Getting Started and {G5,G6} at Operation; assets with privileged-or-policy-mutation or CIA-High labels require hard gates at both Getting Started and Operation and never map to a topology weaker than {G0,G1} before build or {G4,G5,G6} in production.

2.7 Why proportionality is required in practice

[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The systems-capability-debt empirical item found strong evidence that workaround demand arises from delivery gaps and that durable governance architectures route that demand into tiered sanctioned lanes rather than suppressing it with one uniform barrier.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] The access-control-amplification item found that existing core frameworks require least privilege and monitoring but do not themselves describe the machine-speed worst-case permission inheritance mechanism, which means the architecture must instantiate that protection explicitly.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] The implicit-rate-limiting item found that current frameworks do not explicitly treat removed human friction as a control-substitution problem, while analogue evidence from automation transitions shows organizations add engineered pauses, monitoring, and exception routing once throughput increases.
[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] The regulatory-preconditions item concluded that unresolved access-control and data-governance weakness becomes a current or foreseeable control failure once write-capable agents are deployed into the estate.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] Uniform gating therefore fails in both directions: it over-controls low-risk utilities and increases workaround pressure, while it under-specifies the engineered controls that high-risk, high-throughput, and write-capable agents need before they can safely operate.

§3 Reasoning

[fact; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] The evidence clearly supports dynamic authorization as an existing property of ABAC and XACML, so any claim that PBAC is static without qualification would be inaccurate.
[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] The narrower and defensible claim is that topology synthesis is under-specified: the standards define decision semantics, but not the PAP-side meta-policy that maps metadata to a distribution of enforcement surfaces across phases.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/] Lattice or partial-order theory is the right formal tool for monotonicity, while capability-based security is the right derivation tool for minimum-authority coverage; neither source family alone is enough.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The proportionality argument is strongest when tied to operational consequences, because adjacent evidence shows that high-risk agents amplify harm faster while low-risk utilities are the most likely to route around governance if every phase uses the same barrier depth.

§4 Consistency Check

[fact; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] There is no contradiction between saying ABAC and XACML are dynamic and saying a PAP-side topology function is missing, because the first statement concerns decision execution and the second concerns architecture selection.
[fact; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] The reviewed lattice material supports partial-order and least-upper-bound reasoning, but it does not by itself yield the exact invariant taxonomy used here.
[inference; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] The invariant taxonomy and gate basis set are therefore synthesis-level inferences grounded in capability-security and control-catalog logic rather than direct quotations from one source.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Confidence is therefore high for the existence of the gap and the need for monotonic proportionality, and medium for the exact phase-by-phase topology basis proposed here.

§5 Depth and Breadth Expansion

[inference; source: https://davidamitchell.github.io/Research/research/2026-03-15-context-layers-aligned-decisions-synthesis.html] Technical lens: the PAP-side mapping function is structurally a context-routing problem, because the asset's declared invariants and CIA labels determine which governance layers must become active before build, release, and runtime.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] Regulatory lens: hard gates matter most at registration and operation because those are the points where identity scope, attribute integrity, and consequential access decisions become auditable control obligations rather than optional engineering preferences.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Economic lens: proportionality lowers governance cost for low-risk utilities by avoiding unnecessary heavyweight process at the front door while still reserving promotion and runtime control depth for materially risky assets.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Behavioral lens: if informational or low-consequence tools face the same initial barrier depth as transactional or privileged agents, the likely result is more workaround demand rather than more compliance.

§6 Synthesis

(This section seeds the Findings below.)

Executive summary:

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf] A defensible PAP should compute a monotone function F(invariant set, CIA, lifecycle phase) -> PEP topology, where higher-risk metadata never maps to weaker control coverage and incomparable invariants combine by union rather than by averaging.

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://csrc.nist.gov/glossary/term/Risk_Adaptive_Adaptable_Access_Control] Existing ABAC, XACML, and RAdAC material already supports dynamic authorization decisions, and the PAP-side lifecycle-topology derivation problem remains under-specified rather than directly named.

[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] For practical design, the minimal basis set is registration and classification, identity and delegation, development sandbox and connector boundary, delivery and promotion, runtime authorization, runtime rate-limit and exception routing, and evidence and stop-authority gates, with hard gates required at Getting Started and Operation for CIA-High, privileged, or write-capable agents.

[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Proportionality is necessary because uniform gating both over-governs low-risk utilities and under-governs high-risk agents whose machine-speed execution amplifies permission misuse and removes human friction.

Key findings:

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] Existing ABAC and XACML models are already dynamic at authorization time because they evaluate subject, resource, action, and environment attributes through PAP, PDP, PEP, and PIP roles, and the reviewed material leaves lifecycle-topology selection as an implementor-side architectural inference rather than an explicit standards algorithm. Confidence: medium.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-risk-tier-classification-controls.html] A defensible formalisation is a monotone partial order over invariant set and CIA label, because Denning-Sandhu style ordering and highest-triggered-tier logic fit this multi-dimensional risk problem better than either one linear risk score or a literal single-axis secrecy lattice. Confidence: medium.
[inference; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/] Capability-based security supports deriving minimum PEP coverage from declared invariants because precise and minimal delegation is the right model for assets whose authority must stay bounded below both human and system maxima. Confidence: medium.
[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] NIST SP 800-53 provides the component controls from which a proportional topology-selection rule can be built by combining attribute registration, dynamic privilege management, least privilege, dynamic attribute association, and per-request authorization. Confidence: medium.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] The phase-distributed topology should reserve registration and identity gates for Getting Started, sandbox and connector gates for Development, promotion gates for Delivery, and authorization, rate, and stop-authority gates for Operation. Confidence: medium.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] CIA-High, privileged, or write-capable agents require hard gates at Getting Started and Operation because identity scoping, rate controls, and runtime stop authority must exist before those agents can safely enter build or production states. Confidence: medium.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Uniform gate depth is economically and behaviorally unstable because it pushes low-risk utility demand toward workaround channels while failing to add the extra engineered safeguards that materially risky agents need. Confidence: medium.
[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] A worked CIA-High agent that handles PII and executes financial transactions should never map below {G0,G1} at Getting Started, {G1,G2} in Development, {G1,G3} in Delivery, and {G1,G4,G5,G6} in Operation, because each phase exposes a distinct blast-radius mechanism. Confidence: medium.

Evidence map:

Claim	Source	Confidence	Notes
[inference] ABAC and XACML are dynamic for authorization decisions, and the reviewed material leaves lifecycle-topology derivation as an implementor-side inference rather than an explicit standards algorithm.	https://csrc.nist.gov/pubs/sp/800/162/final https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html	medium	Request-time dynamics are direct; the topology-gap statement is still an inference from what the standards do and do not define.
[inference] A monotone partial order is a defensible formal structure for invariant set and CIA composition.	https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-risk-tier-classification-controls.html	medium	Sandhu provides partial-order and least-upper-bound logic, and the risk-tier item supports highest-triggered-tier logic; applying both to this topology problem remains synthesis.
[inference] Capability-based security supports minimum-authority derivation through precise, minimal delegation and confused-deputy avoidance.	https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/	medium	Capability evidence is direct; mapping that evidence to invariant-driven topology derivation is an inferential step.
[inference] NIST SP 800-53 contains the component controls from which proportional topology selection can be built.	https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/	medium	The control extracts are direct, but turning them into a topology-selection rule is still synthesis.
[inference] Lifecycle topology should distribute gates across registration, development, delivery, and operation rather than collapse them into one point.	https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/	medium	Identity work qualifies Getting Started, pipeline work qualifies Delivery, and per-request authorization qualifies Operation.
[inference] CIA-High, privileged, or write-capable agents need hard gates at Getting Started and Operation.	https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html	medium	Adjacent repository work strongly supports this threshold claim, but the evidence base is still a repository-level synthesis rather than independent primary studies.
[inference] Uniform gate depth is unstable because it over-controls low-risk utilities and under-controls high-risk agents.	https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html	medium	Empirical support is strongest on workaround demand and governance architecture, not on a numeric optimum.
[inference] A CIA-High PII-handling transactional agent maps to a topology that includes registration, identity, promotion, runtime authorization, rate, and stop-authority gates.	https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/ https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html	medium	Worked example is synthesis, not a standard-defined template.

Assumptions:

[fact; source: https://github.com/davidamitchell/Research/blob/main/Research/in-progress/2026-04-27-pap-dynamic-policy-profiling-proportionality.md] No standalone assumption entries are carried into Findings; the invariant taxonomy, gate basis set, and worked topology are explicitly labeled as inferences in this document rather than being presented as unsupported assumptions.

Analysis:

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] The strongest interpretive move in this item is separating decision dynamism from topology dynamism, because that avoids the false claim that modern access-control theory is static while still identifying an architectural gap worth solving.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] The lattice material was weighted as structural guidance rather than as a ready-made solution, because it directly supports ordering, joins, and monotonicity but does not decide which enterprise invariants matter operationally.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-risk-tier-classification-controls.html] Alternative formalisations were considered and rejected at a high level: a single linear score collapses incomparable hazards into one number, while a literal single-axis secrecy lattice does not fit mixed confidentiality, integrity, and operational-authority invariants as well as a partial-order with highest-triggered-tier logic.
[inference; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/] The capability literature was weighted as the derivation principle for invariant classes, because precise delegation and least authority explain why a PAP should read invariant declarations as claims about the minimum set of enforcement surfaces required.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The repository's adjacent items were used to resolve the proportionality question, because they provide the operational consequence evidence missing from the formal models and explain why uniform gating is both behaviorally brittle and technically insufficient.
[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] The resulting mapping rule is therefore best read as an implementor's design specification built from standards-compatible control primitives rather than as a claim that one standards body already publishes this exact formula.

Risks, gaps, uncertainties:

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] No reviewed primary source explicitly publishes a PAP function from invariant metadata to lifecycle PEP topology, so the exact formula remains a synthesis rather than a directly sourced standard pattern.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] The lattice evidence is structurally strong, but the source used here is a concise teaching summary rather than the original Denning or Bell-LaPadula papers, so the formalism claim is high-confidence for ordering logic and medium-confidence for any stronger historical reading.
[inference; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf] The capability source is strong on least-authority delegation, but it does not discuss lifecycle phase design, so the jump from delegation theory to phase-distributed topology remains inferential.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The empirical case is strongest for why uniform control patterns fail and weaker for any exact threshold where a soft gate should become a hard gate.

Open questions:

How should the PAP encode joins between incomparable invariants when one asset spans regulated data, financial transactions, and privileged configuration change in the same workflow?
What evidentiary thresholds should automatically reclassify an asset from soft-gated to hard-gated operation after deployment drift, connector growth, or new data exposure?
Which downstream runtime patterns, transaction signing, supervisory approval, or anomaly-triggered suspension, best implement the G4-G6 operational topology for the highest-risk assets?

§7 Recursive Review

[fact; source: https://github.com/davidamitchell/Research/blob/main/Research/in-progress/2026-04-27-pap-dynamic-policy-profiling-proportionality.md] Every factual claim in the investigation and findings is either source-bound or explicitly labeled as an inference, and the strongest conclusion is framed as a standards-compatible synthesis rather than as a claim of direct standards text.
[fact; source: https://github.com/davidamitchell/Research/blob/main/Research/in-progress/2026-04-27-pap-dynamic-policy-profiling-proportionality.md; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Adjacent completed items touching access control, identity, rate limiting, systems capability debt, and delivery governance were re-scanned and incorporated where they materially qualified the same control surface.
[fact; source: https://github.com/davidamitchell/Research/blob/main/Research/in-progress/2026-04-27-pap-dynamic-policy-profiling-proportionality.md] Acronym first-use expansion, inline claim labeling, source binding, and synthesis-to-findings parity were checked inline during drafting.

Findings

(Populated from section 6 Synthesis above.)

Executive Summary

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf] A defensible PAP should compute a monotone function F(invariant set, CIA, lifecycle phase) -> PEP topology, where higher-risk metadata never maps to weaker control coverage and incomparable invariants combine by union rather than by averaging.

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://csrc.nist.gov/glossary/term/Risk_Adaptive_Adaptable_Access_Control] Existing ABAC, XACML, and RAdAC material already supports dynamic authorization decisions, and the PAP-side lifecycle-topology derivation problem remains under-specified rather than directly named.

[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] For practical design, the minimal basis set is registration and classification, identity and delegation, development sandbox and connector boundary, delivery and promotion, runtime authorization, runtime rate-limit and exception routing, and evidence and stop-authority gates, with hard gates required at Getting Started and Operation for CIA-High, privileged, or write-capable agents.

[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Proportionality is necessary because uniform gating both over-governs low-risk utilities and under-governs high-risk agents whose machine-speed execution amplifies permission misuse and removes human friction.

Key Findings

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] Existing ABAC and XACML models are already dynamic at authorization time because they evaluate subject, resource, action, and environment attributes through PAP, PDP, PEP, and PIP roles, and the reviewed material leaves lifecycle-topology selection as an implementor-side architectural inference rather than an explicit standards algorithm. Confidence: medium.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-risk-tier-classification-controls.html] A defensible formalisation is a monotone partial order over invariant set and CIA label, because Denning-Sandhu style ordering and highest-triggered-tier logic fit this multi-dimensional risk problem better than either one linear risk score or a literal single-axis secrecy lattice. Confidence: medium.
[inference; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/] Capability-based security supports deriving minimum PEP coverage from declared invariants because precise and minimal delegation is the right model for assets whose authority must stay bounded below both human and system maxima. Confidence: medium.
[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] NIST SP 800-53 provides the component controls from which a proportional topology-selection rule can be built by combining attribute registration, dynamic privilege management, least privilege, dynamic attribute association, and per-request authorization. Confidence: medium.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/] The phase-distributed topology should reserve registration and identity gates for Getting Started, sandbox and connector gates for Development, promotion gates for Delivery, and authorization, rate, and stop-authority gates for Operation. Confidence: medium.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] CIA-High, privileged, or write-capable agents require hard gates at Getting Started and Operation because identity scoping, rate controls, and runtime stop authority must exist before those agents can safely enter build or production states. Confidence: medium.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Uniform gate depth is economically and behaviorally unstable because it pushes low-risk utility demand toward workaround channels while failing to add the extra engineered safeguards that materially risky agents need. Confidence: medium.
[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] A worked CIA-High agent that handles PII and executes financial transactions should never map below {G0,G1} at Getting Started, {G1,G2} in Development, {G1,G3} in Delivery, and {G1,G4,G5,G6} in Operation, because each phase exposes a distinct blast-radius mechanism. Confidence: medium.

Evidence Map

Claim	Source	Confidence	Notes
[inference] ABAC and XACML are dynamic for authorization decisions, and the reviewed material leaves lifecycle-topology derivation as an implementor-side inference rather than an explicit standards algorithm.	https://csrc.nist.gov/pubs/sp/800/162/final https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html	medium	Request-time dynamics are direct; the topology-gap statement is still an inference from what the standards do and do not define.
[inference] A monotone partial order is a defensible formal structure for invariant set and CIA composition.	https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-risk-tier-classification-controls.html	medium	Sandhu provides partial-order and least-upper-bound logic, and the risk-tier item supports highest-triggered-tier logic; applying both to this topology problem remains synthesis.
[inference] Capability-based security supports minimum-authority derivation through precise, minimal delegation and confused-deputy avoidance.	https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/	medium	Capability evidence is direct; mapping that evidence to invariant-driven topology derivation is an inferential step.
[inference] NIST SP 800-53 contains the component controls from which proportional topology selection can be built.	https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/	medium	The control extracts are direct, but turning them into a topology-selection rule is still synthesis.
[inference] Lifecycle topology should distribute gates across registration, development, delivery, and operation rather than collapse them into one point.	https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/	medium	Identity work qualifies Getting Started, pipeline work qualifies Delivery, and per-request authorization qualifies Operation.
[inference] CIA-High, privileged, or write-capable agents need hard gates at Getting Started and Operation.	https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html	medium	Adjacent repository work strongly supports this threshold claim, but the evidence base is still a repository-level synthesis rather than independent primary studies.
[inference] Uniform gate depth is unstable because it over-controls low-risk utilities and under-controls high-risk agents.	https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html	medium	Empirical support is strongest on workaround demand and governance architecture, not on a numeric optimum.
[inference] A CIA-High PII-handling transactional agent maps to a topology that includes registration, identity, promotion, runtime authorization, rate, and stop-authority gates.	https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/ https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/ https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html	medium	Worked example is synthesis, not a standard-defined template.

Assumptions

[fact; source: https://github.com/davidamitchell/Research/blob/main/Research/in-progress/2026-04-27-pap-dynamic-policy-profiling-proportionality.md] No standalone assumption entries are carried into Findings; the invariant taxonomy, gate basis set, and worked topology are explicitly labeled as inferences in this document rather than being presented as unsupported assumptions.

Analysis

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] The strongest interpretive move in this item is separating decision dynamism from topology dynamism, because that avoids the false claim that modern access-control theory is static while still identifying an architectural gap worth solving.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] The lattice material was weighted as structural guidance rather than as a ready-made solution, because it directly supports ordering, joins, and monotonicity but does not decide which enterprise invariants matter operationally.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-risk-tier-classification-controls.html] Alternative formalisations were considered and rejected at a high level: a single linear score collapses incomparable hazards into one number, while a literal single-axis secrecy lattice does not fit mixed confidentiality, integrity, and operational-authority invariants as well as a partial-order with highest-triggered-tier logic.
[inference; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/] The capability literature was weighted as the derivation principle for invariant classes, because precise delegation and least authority explain why a PAP should read invariant declarations as claims about the minimum set of enforcement surfaces required.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The repository's adjacent items were used to resolve the proportionality question, because they provide the operational consequence evidence missing from the formal models and explain why uniform gating is both behaviorally brittle and technically insufficient.
[inference; source: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-3/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-6/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-16/; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-24/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] The resulting mapping rule is therefore best read as an implementor's design specification built from standards-compatible control primitives rather than as a claim that one standards body already publishes this exact formula.

Risks, Gaps, and Uncertainties

[inference; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html] No reviewed primary source explicitly publishes a PAP function from invariant metadata to lifecycle PEP topology, so the exact formula remains a synthesis rather than a directly sourced standard pattern.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf] The lattice evidence is structurally strong, but the source used here is a concise teaching summary rather than the original Denning or Bell-LaPadula papers, so the formalism claim is high-confidence for ordering logic and medium-confidence for any stronger historical reading.
[inference; source: https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf] The capability source is strong on least-authority delegation, but it does not discuss lifecycle phase design, so the jump from delegation theory to phase-distributed topology remains inferential.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The empirical case is strongest for why uniform control patterns fail and weaker for any exact threshold where a soft gate should become a hard gate.

Open Questions

How should the PAP encode joins between incomparable invariants when one asset spans regulated data, financial transactions, and privileged configuration change in the same workflow?
What evidentiary thresholds should automatically reclassify an asset from soft-gated to hard-gated operation after deployment drift, connector growth, or new data exposure?
Which downstream runtime patterns, transaction signing, supervisory approval, or anomaly-triggered suspension, best implement the G4-G6 operational topology for the highest-risk assets?

Output

[fact; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/] Type: knowledge.
[inference; source: https://profsandhu.com/infs767/infs767spring04/lbac-6pg.pdf; https://classpages.cselabs.umn.edu/Fall-2021/csci5271/papers/SRL2003-02.pdf; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Description: a standards-compatible formal mapping from invariant metadata and CIA rating to lifecycle-aware enforcement topology, plus a worked high-risk example and PAP design criteria.
[fact; source: https://csrc.nist.gov/pubs/sp/800/162/final; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/] Links: https://csrc.nist.gov/pubs/sp/800/162/final ; https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html ; https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/