Cross Domain Edges

Cross-domain edges

Edge IDs combine two domain letters in alphabetical order and a sequence number (AB1, CG1). A pair can have several edges. PandaWard creates an edge only when the inventory has concrete assets for every condition, and lists those assets as provenance. It never creates the full cross product of domains.

An edge's status comes from its linked controls:

• any linked control FAIL: edge FAIL
• any linked control undecided (BLOCKED, UNSUPPORTED, ERROR, ...): edge BLOCKED
• only SUSPECTED left: edge SUSPECTED
• all PASS: edge PASS

Edge	Title	Scenario	Instantiated when	Linked controls
AB1	Discovered login endpoints -> session tests	New auth route missing token/session coverage	auth_routes	A-002, B-003, B-004
AC1	Asset owners -> access policies	Orphan routes lack authorization checks	routes	C-002, C-003
AD1	Input entrypoints -> sinks	Ingress path crosses a parsing or command boundary	route_files_with_sinks	D-001, D-002, D-003, D-004, D-005
AE1	Asset classification -> secret scan	Secret material flows into config, workflow or IaC	secrets_in_config	E-001, E-002
AG1	Service inventory -> API coverage	Undocumented endpoints bypass contract tests	openapi, routes	A-003, G-002
AJ1	Cloud-deployed asset -> exposure	Private API exposed by ingress or policy drift	routes, deploy_config	J-001, J-003, J-004
BC1	Authenticated identity -> authorization	Valid user can access another tenant's object	auth_routes, param_routes	C-001
CG1	Object access -> API response	Mass assignment or property-level data access	param_routes	C-001, G-002
DG1	Webhook input -> API trust	Unsigned callback payload drives privileged state	webhooks	G-001
DH1	HTML output -> browser	Unescaped backend content reaches the DOM	html_sinks	H-001
DP1	Prompt content -> tools	Untrusted retrieved text triggers a tool action	llm	P-001, P-003
EI1	Secrets -> dependencies	Package lifecycle script obtains environment secret	install_scripts, github_workflows	I-002, N-002
FG1	Payment state -> webhooks	Replay moves payment into an invalid terminal state	payments, webhooks	F-001, G-001
FQ1	State machine -> race	Concurrent requests bypass idempotency	payments	F-002, Q-002
HJ1	Web headers -> CDN/edge config	Edge overrides CSP or cache policy	headers_observed, deploy_config	H-003, J-004
IN1	Action dependency -> CI integrity	Unpinned third-party action may change code	third_party_actions	N-001
BK1	Mobile identity -> Android storage	Token copied to Android insecure storage	android, auth	K-001, K-003
BL1	Mobile identity -> iOS keychain	Session material stored outside platform controls	ios, auth	L-001, L-002
JP1	IAM -> MCP credentials	Agent receives wider credentials than the tool requires	mcp_config	P-002

Example: in a project with GET /api/invoices/:id, edge CG1 is created with that route as provenance. Its control C-001 (object-level authorization) needs a runtime test, so CG1 stays BLOCKED until it is decided. The report shows this even if every static check in domains C and G passed.

pandaward graph
pandaward graph --format mermaid