okhp3-lateral-movement-tracking

原文涵盖的主题

• okhp3-lateral-movement-tracking
• Outcome
• Scope
• Inputs
• Procedure
• Validation loop
• Safety and failure boundaries
• Output contract

OverKill Hill P³ · overkillhill.com · github.com/OKHP3 Maintain an attributable call graph and route suspicious path changes to proportionate review. Work only with the approved evidence, environment, and decision boundary named in the inputs. This package produces analytical or lab evidence; it does not grant authority, expand scope, or prove live-system security. Approved call telemetry, capability inventory, baseline graph, identity data, policy, and maintenance exceptions. 1. Confirm scope, authority, owner, evidence status, and stop conditions. 2. Normalize caller, callee, tool, identity, permission, time, and data class 3. compare with approved graph 3. correlate path and privilege changes 3. consider benign explanations 3. route containment through governance. Compare the result with the stated scope, expected output, and evidence tier. Reconcile contradictions, missing prerequisites, and benign explanations before a conclusion. Record the reviewer, timestamp, limitations, and next authorized action; return blocked or defer-for-evidence when needed. Detect abnormal agent-to-agent, service-to-service, and tool-call paths. Use when monitoring authorization boundaries, capabili

这里只展示节选，请以完整原文和当前要求为准。