Secret Sprawl¶

Diagnose a credential's danger not by whether its primary store is locked but by whether its copies have spread into more places than the issuer tracks, so revocability collapses and rotation cost scales with the unknown copy count.

Core Idea¶

Secret sprawl is the information-security failure state in which a class of access-granting tokens — passwords, API keys, signing credentials, session secrets, certificates, encryption keys — proliferates into more storage locations, configurations, and holders than the issuing authority tracks, causing revocability to collapse: the ability to deactivate the token everywhere it can act becomes practically unavailable because the set of copies is not fully enumerable.

The mechanism runs as follows. An access-granting credential is issued for a legitimate purpose and stored in a primary location. From there it spreads — copied into a developer's local environment to test a service integration, embedded in a CI pipeline configuration, pasted into a shared team password manager, checked into a feature branch, included in a container image, forwarded in a Slack message to a colleague, replicated into a disaster-recovery configuration. Each copy is cheap to make and often invisible to the credential's original issuer. The issuing authority's registry records the credential as existing in one or a few known locations; the actual copy count has grown beyond that record without any update to it. The credential now acts everywhere it has been copied, but the issuer cannot enumerate that set. When a rotation or revocation is required — because a security incident has occurred, because a developer has left the organisation, because an audit has flagged the credential's age — "rotate the credential" translates in practice to "locate and update every copy," and that set is partially or wholly unknown. The cost of rotation therefore scales with the number of unknown copies rather than with the number of known ones, making it super-linear in sprawl. In practice, rotations simply do not happen on credentials with high sprawl, and the credential's effective lifetime becomes indefinite.

The diagnostic the failure establishes is a shift from storage safety (is the primary location secure?) to revocation closure (can we reach every place this token currently acts, in bounded time, if we need to?). The intervention family follows: inventorying the copy graph by treating each token as a node and each custodian as an edge; replacing long-lived credentials with short-lived automatically-rotating tokens whose sprawl is bounded by their lifetime; routing all access through a credential broker that issues fresh tokens at use time so the live-copy set is always known; and preferring capability tokens that name specific permitted actions over ambient credentials that grant broad authority, so partial-graph revocation is still effective.

Structural Signature¶

Sig role-phrases:

the access-granting token — a copyable carrier of revocable authority (password, API key, signing credential, session secret, certificate, encryption key)
the issuing authority — the party that minted the token and is expected to track where it lives
the registry — the issuer's index of known storage locations, recording only a few of the copies
the copy graph — the structure where each token is a node and each custodian a directed edge; its dangerous property is the token's out-degree
the cheap-copy / costly-revoke asymmetry — the load-bearing imbalance: each copy is trivial to make and often invisible to the issuer, while revocation cost scales with the copy count
the silent fan-out — the uncatalogued propagation events (Slack forward, cloned branch, colleague's laptop, disaster-recovery replica) that no audit trail recorded
the revocation closure — the binding property: can the issuer reach every place the token now acts, in bounded time, to deactivate it?
the revocation gap — the failure: unknown edges in the copy graph make the live set unenumerable, so rotation cost is super-linear in sprawl and the token's effective lifetime drifts toward indefinite
the bounding remedies — the closed menu keyed to how each bounds the copy set: by time (short-lived auto-rotating tokens), by issuance (a broker minting fresh tokens at use), or by scope (capability tokens surviving partial-graph revocation)

What It Is Not¶

Not a storage problem. Secret sprawl is a property of the copy graph, not of any one vault: a perfectly secured primary store with an unenumerable set of copies is exposed, and a token with a small, fully-observed graph is safe even if no single store is hardened beyond the rest. The binding question shifts from "is this location locked down?" to "do we know everywhere this token can act, and could we deactivate all of them in a bounded window?"
Not a breach or a leak. Nothing exited a perimeter; the system was dispersed, not penetrated. Sprawl is the pre-leakage state in which the legitimate holder set multiplied beyond the issuer's index, so the binding constraint is revocation, not exit. The credential acts everywhere it was copied — all of it sanctioned — and the failure is the inability to recall it.
Not about the secret's strength or secrecy. A long, high-entropy, well-guarded credential is fully sprawled the moment its copies outrun the registry; the defect is collapsed revocability, not weak confidentiality. Hardening or lengthening the token does nothing for revocation closure — the failure is that authority cannot be withdrawn in bounded time, regardless of how good the secret is.
Not rotation cost that scales with known copies. "Rotate the credential" means "locate and update every copy," so its cost is super-linear in the unknown copy count, not the recorded one. This is exactly why the credentials most in need of rotation — the oldest and most widely used — are the hardest to rotate, and why rotations on heavily sprawled secrets quietly never happen.
Not escape-and-leakage or a containment failure. Escape/leakage names the exit event of a constrained quantity through an unintended pathway; a containment failure is a breached perimeter. Secret sprawl is neither — the perimeter is intact and nothing escaped; the holder set multiplied inside it, making withdrawal rather than exit the failure mode.
Not present where there is no copyable artifact and issuer. Applied to diffuse social influence, reputation, or soft power, "secret sprawl" is metaphor with no mechanism behind it: there is no token to copy and no central issuer who could call authority back, so the defining move — revocation — has no analog. You cannot rotate a reputation; the framing's force depends on a revocable copyable artifact being literally present.

Scope of Application¶

Secret sprawl is at home in information security, but its mechanism lives wherever the authority-as-artifact-with-a-central-issuer structure is literally present — a copyable token of revocable authority, an issuer expected to track its holders, and a copy graph that outruns the registry. The habitats below are genuine co-instances of that same machinery, not metaphor; where there is no copyable artifact and no issuer who could call authority back (reputation, soft power), the defining move — revocation — has no analog, and the portable lesson there belongs to the parent delegation_of_authority / revocation-closure primes.

Information security (home) — credential, key, and token sprawl: passwords, API keys, signing credentials, certificates, and encryption keys spreading across services, code, CI runners, container images, and operator workstations.
Building-key management — physical key sets and door codes dispersed across holders, recoverable only through re-keyable cores when the holder set is incompletely known.
Notarial and seal-based systems — seals and signing authority tracked by a sealed register plus a recall journal, the copy graph being the clerks and envoys holding impressions.
Regulatory licensing and clinical credentialing — issued entitlements, break-glass EHR accounts, medication-cabinet codes, and just-in-time provisioning across many shift workers.
Historical statecraft — royal seals and signet rings copied to clerks, governors, and envoys, recallable only by physical recovery from an incompletely-known holder set: the identical failure centuries earlier.

Clarity¶

Naming secret sprawl converts credential management from a storage problem into a graph problem, and that reframing is the whole of its clarifying force. Without the label, a security team's mental model of a secret is a single guarded location, and "are we secure?" decomposes into "is that location locked down?" — a question that can be answered yes while the credential silently exists in twenty other places. With the label, each secret becomes a node whose dangerous property is its out-degree: the unknown set of copies, each reachable through some custodian edge. The sharp question is no longer "is this storage safe?" but "do we know everywhere this token can act, and could we deactivate all of them in a bounded window?" That is revocation closure, and it is a property of the copy graph, not of any one vault.

The reframing also sharpens what an access event means and where the real cost lives. "This person had access" becomes "this person, plus everyone they propagated the secret to, had access" — surfacing the silent fan-outs (the Slack forward, the cloned branch, the colleague's laptop) that no audit trail recorded. And it explains a failure that storage-thinking cannot: why rotation simply does not happen on the most sprawled credentials. Once "rotate" is understood to mean "locate and update every copy," its cost is seen to scale with the unknown copy count rather than the known one, so the credentials most in need of rotation are precisely the ones hardest to rotate, and their effective lifetime drifts toward indefinite. Localizing the breakdown to revocation closure — rather than to storage hygiene or attacker capability — is what tells the team that the fix lives in bounding the copy set (short-lived auto-rotating tokens, broker-issued credentials, capability tokens that survive partial-graph revocation), not in hardening any single store.

Manages Complexity¶

The security posture of a credentialed system, asked about wholesale, is a high-dimensional and open-ended thing: every secret, every store, every holder, every threat actor, every path an attacker might take. "Are we secure?" admits no bounded answer, and a team that tries to enumerate threats faces a list with no natural end. Secret sprawl compresses that whole posture, for the class of access-granting tokens, into a single graph property: revocation closure — for each token, is the set of places it can act bounded, named, and reachable for deactivation in a finite window? The question of whether the organization is safe against credential compromise stops being an unbounded threat-enumeration and becomes a property of one structure, the copy graph, in which each secret is a node and each custodian a directed edge. The analyst no longer reasons about attackers at all; they reason about whether a graph is fully observed.

What that collapse lets the team track is the out-degree of each token node — the known versus unknown copy set — in place of the diffuse "is this secure." A token whose copy graph is fully enumerable has revocation closure and is safe under recall; a token whose graph has unknown edges does not, and the gap is read directly off the missing edges rather than re-derived from a fresh threat model per credential. The same single property reprices the operations that storage-thinking cannot explain: "this person had access" expands, by following edges, to "this person plus everyone downstream of them," and the cost of rotation is read off the graph as scaling with the unknown copy count — which is why the most sprawled credentials are precisely the ones that never get rotated, their effective lifetime drifting toward indefinite. One graph property predicts the access fan-out, the rotation cost, and the revocation gap together.

The branch structure the compression imposes is what makes the remedy selectable rather than improvised, because it sorts every intervention by how it bounds the copy set rather than by which store it hardens. Reading the failure as a copy-graph property forks the fixes cleanly: bound the set by time (short-lived auto-rotating tokens, whose sprawl can never exceed their lifetime), bound it by issuance (a broker that mints fresh tokens at use so the live set is always known), or survive an unbounded set by scope (capability tokens naming specific actions, so partial-graph revocation still cuts off authority). A practitioner therefore stops asking the unanswerable "are we secure?" and asks, per token, a finite and checkable question — is its copy graph enumerable, and if not, which of the three bounding moves applies — turning an open-ended security posture into a single per-node graph property with a small, closed menu of structural fixes keyed to it.

Abstract Reasoning¶

Secret sprawl licenses a set of reasoning moves in information security, all turning on its central reframing — a secret is a node in a copy graph whose dangerous property is its out-degree (the set of copies, each reachable through a custodian edge) — and on the property that property defines: revocation closure.

The signature diagnostic move evaluates a credential by asking whether its copy graph is fully observed rather than whether its primary store is locked down. The reasoner asks, per token, "do we know everywhere this token can act, and could we deactivate all of them in a bounded window?" — and infers exposure directly from the missing edges: a token whose copy graph is fully enumerable has revocation closure and is safe under recall; a token with unknown edges does not, and the gap is read off the unobserved part of the graph rather than re-derived from a fresh threat model. Crucially, the reasoner stops reasoning about attackers at all and reasons about whether a graph is fully observed — converting "are we secure?" from an unbounded threat-enumeration into a checkable property of one structure.

A fan-out / propagation move follows edges to reprice an access event. "This person had access" is not read literally but expanded along the copy graph to "this person plus everyone downstream of them" — surfacing the silent fan-outs (the Slack forward, the cloned branch, the colleague's laptop, the disaster-recovery replica) that no audit trail recorded. The reasoner infers the true blast radius of a credential from its out-degree, not from the issuer's registry, which records only the few known locations.

A cost-prediction move reads rotation difficulty off the same graph and explains a failure storage-thinking cannot. Because "rotate the credential" means in practice "locate and update every copy," its cost scales with the unknown copy count rather than the known one — super-linear in sprawl. From this the reasoner predicts the field's characteristic pathology: the credentials most in need of rotation (oldest, most widely used) are precisely the most sprawled and therefore the hardest to rotate, so rotations quietly do not happen and effective credential lifetime drifts toward indefinite. One graph property predicts the access fan-out, the rotation cost, and the revocation gap together.

The interventionist move sorts remedies by how each bounds the copy set rather than by which store it hardens, yielding a small closed menu keyed to the diagnosis. Bound the set by time — short-lived automatically-rotating tokens, whose sprawl can never exceed their lifetime. Bound it by issuance — route all access through a credential broker that mints fresh tokens at use time, so the live-copy set is always known. Or survive an unbounded set by scope — capability tokens that name specific permitted actions rather than granting ambient authority, so partial-graph revocation still cuts off authority even when the holder set is incompletely known. The reasoner selects among the three by predicting which can restore bounded revocability for the token at hand, and predicts the effect of each (sprawl bounded by lifetime, live set always enumerable, or partial revocation still effective).

Underlying all of these is a boundary-drawing move that localizes the failure to revocation closure rather than to storage hygiene or attacker capability — and so insists the fix lives in bounding the copy set, not in hardening any single vault. The reasoner draws the line: a perfectly secured primary store with an unenumerable copy graph is exposed, and a token with a small enumerable graph is safe even if no single store is hardened beyond the rest, because the binding property is whether authority can be withdrawn in bounded time.

Knowledge Transfer¶

Within information security secret sprawl transfers as mechanism. The copy-graph reframing (each secret a node whose dangerous property is its out-degree), the revocation-closure diagnostic (do we know everywhere this token can act, and could we deactivate all of them in a bounded window?), the fan-out repricing of an access event, the cost-prediction that rotation scales with the unknown copy count (so the most sprawled credentials are the least rotated), and the three-way remedy menu keyed to how each bounds the copy set (time: short-lived auto-rotating tokens; issuance: a credential broker minting fresh tokens at use; scope: capability tokens surviving partial-graph revocation) carry intact across the credential classes that share the substrate — passwords, API keys, signing credentials, session secrets, certificates, encryption keys, across services, code, CI runners, container images, and operator workstations. The transfer is mechanical here because each is the same substrate — an access-granting token cheap to copy but bound to authority that must remain revocable — so the copy-graph property and its bounding moves refer to the same machinery throughout.

Unusually, the mechanical transfer extends past information security to any substrate where the same authority-as-artifact-with-a-central-issuer structure is literally present — and this is the key to characterizing its reach honestly. Building-key management (re-keyable cores), notarial and seal-based systems (sealed register plus recall journal), regulatory licensing, and clinical credentialing (just-in-time provisioning, break-glass EHR accounts, medication-cabinet codes) all instantiate the same machinery: a copyable token of revocable authority, an issuer expected to track its holders, and a copy graph that outruns the registry. The interventions hardened in cryptographic key management therefore port cleanly to those systems, and the historical-statecraft case (royal seals and signet rings copied to clerks, governors, and envoys, recallable only by physical recovery from an incompletely-known holder set) is the same failure centuries earlier. These are co-instances of one domain-specific pattern, not independent prime-level applications — which is precisely why the breadth does not lift secret sprawl to a prime: its extra-domain instances are re-descriptions of the same authority-token machinery rather than new substrates exercising a substrate-independent signature.

Where that machinery is absent, the transfer fails, and this marks the honest boundary. In non-token substrates — diffuse social influence, reputation, soft power — there is no copyable artifact and no central issuer who could call authority back, so the defining move, revocation, has no analog: you cannot rotate a reputation. So invoking "secret sprawl" there would be case (A) metaphor with no mechanism behind it. What genuinely travels at that level of abstraction is the parent pattern the failure instantiates — a revocable right bound to a copyable carrier whose copying outpaces the issuer's index, best carried by existing primes delegation_of_authority (authority granted along paths that go uncatalogued), escape_and_leakage and containment (the perimeter is intact but the holder set multiplied inside it), and a candidate revocation-closure prime (for any granted right, can the authority reach every place it now acts, in bounded time?) that would graft onto delegation-of-authority and is broader than secret sprawl. What stays home-bound is everything token-specific: the credential taxonomy, rotation and broker mechanics, capability tokens, and the copy-graph custodian edges are access-control machinery that presupposes an artifact and an issuer. So the honest cross-domain lesson is to carry the parent (delegation of authority / revocation closure / the authority-as-artifact framing) only where a revocable copyable artifact with an issuer is actually present; "secret sprawl," as named, carries access-control-substrate baggage, and its structural force depends on that framing being literally present — which is exactly why it is a sharp domain-specific specialization rather than a prime. (See Structural Core vs. Domain Accent.)

Examples¶

Canonical¶

The defining instance is a cloud provider access key that escapes its issuer's index. A developer generates an AWS access key to let a service reach S3 and, for expedience, hardcodes it into application config. That config is committed to a Git repository, copied into the CI pipeline's environment, baked into a container image pushed to a registry, pasted into a Slack thread to unblock a teammate, and cloned onto three laptops. IAM — the issuing authority — still records the key as belonging to one principal; the true number of live copies is unknown to it. Public-repo scanning bots (and AWS's own automated scanners) routinely find such keys within minutes of a push. When the key must be killed, "rotate it" means "find and update every copy," a set nobody can fully enumerate, so the safe move collapses to deactivating the key and racing to fix whatever breaks.

Mapped back: The AWS key is the access-granting token and IAM the issuing authority whose registry lists one holder. The commit, the image, the Slack paste, and the laptop clones are silent fan-outs that grow the copy graph's out-degree past the record — the cheap-copy / costly-revoke asymmetry. Because the live set is unenumerable, revocation closure is lost: the revocation gap is exactly why rotation cost runs super-linear in sprawl.

Applied / In Practice¶

The January 2023 CircleCI security incident is a real-world demonstration and a field deployment of the remedy logic. After attackers compromised a CircleCI engineer's machine and potentially exfiltrated customers' stored environment variables, tokens, and keys, CircleCI could not know which specific secrets had been read, so it instructed every customer to rotate all secrets stored in the platform — a mass, cross-organization rotation whose cost was set entirely by how far each customer's secrets had sprawled. The episode pushed the industry-standard bounding remedies: replacing long-lived stored keys with short-lived OIDC/workload-identity tokens issued just-in-time by a broker, so the live-copy set is always known and its lifetime caps the sprawl.

Mapped back: CircleCI functioned as a custodian node whose compromise expanded every customer's copy graph; the inability to say which secrets leaked is the revocation gap. The blanket "rotate everything" order is the cost-prediction realized — rotation cost scaling with the unknown copy count. Moving to just-in-time OIDC tokens is the bounding remedy by time and issuance: bound the set by lifetime and by broker-issuance so revocation closure is restored.

Structural Tensions¶

T1: Legitimate propagation versus revocability (the sprawl is the system working). Every copy that produces sprawl is made for a good reason: a developer copies a key to test an integration, CI needs it to deploy, a disaster-recovery configuration replicates it precisely so the system survives a failure, a teammate is unblocked by a Slack paste. The same behaviours that make a credentialed system usable, resilient, and fast are what grow the copy graph beyond the registry. The tension is that revocation closure and operational fluidity pull against each other — you cannot forbid copying without crippling the workflows and redundancy the organization depends on, yet every sanctioned copy erodes the ability to withdraw authority in bounded time. Sprawl is not misuse; it is the accumulated residue of legitimate use, which is why hardening against attackers never addresses it. Diagnostic: Is each copy of this token an abuse to be stopped, or a legitimate operational need whose revocability cost must instead be bounded structurally?

T2: Bounding by issuance versus concentration risk (the broker is a chokepoint). The issuance remedy — route all access through a credential broker that mints fresh tokens at use, so the live-copy set is always known — restores revocation closure by making the graph enumerable. But it does so by concentrating authority in a single issuer whose own compromise sprawls every downstream token at once: the CircleCI incident is exactly this, a custodian node whose breach expanded every customer's copy graph simultaneously. The tension is that bounding sprawl by centralizing issuance trades a diffuse, hard-to-revoke copy set for a concentrated, catastrophic single point of failure — the very "one guarded location" model whose insufficiency motivated the concept, now re-created at the broker. Revocation closure is regained, but the blast radius of the issuer's own failure is maximized. Diagnostic: Does routing through a broker make the live set enumerable without making the broker a target whose compromise sprawls everything it ever issued?

T3: Short-lived auto-rotation versus operational churn (revocability bought with instability). Bounding the copy set by time — credentials whose sprawl can never exceed their brief lifetime — is the cleanest structural fix, because an expired copy is inert wherever it landed. But short lifetimes mean constant rotation, and rotation is exactly the operation that breaks things: a token that lapses mid-job, a consumer that fails to refresh, an outage traced to an expiry nobody scheduled around. The tension is that the same mechanism that caps sprawl (frequent, automatic expiry) raises the rate of rotation-induced failures, so the availability cost that made teams avoid rotating long-lived credentials reappears as chronic churn. Revocability improves precisely by making the system rotate more often, which is what the sprawled-credential pathology existed to avoid. Diagnostic: Can every consumer of this token tolerate its lifetime expiring and refreshing, or does short-lived rotation trade an unenumerable copy set for recurring availability failures?

T4: Capability scope versus management overhead (surviving partial revocation costs granularity). The scope remedy — capability tokens that name specific permitted actions rather than granting ambient authority — is the only one that survives an unbounded copy set, because revoking part of the graph still cuts off the named authority. But narrow, action-specific tokens multiply: where one ambient credential once served, there are now many capabilities to mint, track, and expire, each a node in its own right, and the administrative surface grows with the granularity. The tension is that least-authority survivability under partial revocation is bought by trading a small number of convenient broad credentials for a large number of narrow ones — reducing per-token blast radius while increasing the count of tokens and the bookkeeping the copy-graph model must now cover. Diagnostic: Does scoping to specific actions cut the blast radius enough to justify the proliferation of capability tokens it creates, or does the added token count reintroduce sprawl of a different kind?

T5: Revocation-closure diagnostic versus the invisibility it must overcome (a test that presupposes what the failure hides). The diagnostic asks, per token, "do we know everywhere this token can act, and could we deactivate all of them in bounded time?" — reading exposure off the missing edges of the copy graph. But the defining feature of sprawl is that the dangerous copies are silent fan-outs no audit trail recorded: the Slack forward, the cloned branch, the laptop copy are exactly the edges the issuer cannot see. So the test's key input — a fully observed graph — is definitionally unavailable precisely where sprawl is worst, and a team can believe it has revocation closure while unknown edges make that belief false. The tension is that the diagnostic demands visibility into the one thing the failure guarantees is hidden, so its confident "yes, we can revoke" is least trustworthy when it matters most. Diagnostic: Is "we know all the copies" established by evidence that the graph is complete, or merely by the absence of evidence of copies the system was never able to record?

T6: Autonomy versus reduction (a security failure state or an instance of delegation and revocation closure). Secret sprawl is a sharp, mechanistic information-security pattern — copy graph, out-degree, cheap-copy/costly-revoke asymmetry, the three-way bounding menu — and unusually its mechanism transfers intact to every authority-as-artifact-with-a-central-issuer substrate: building keys, notarial seals, royal signets copied to envoys are co-instances of the same machinery, not metaphors. But that breadth does not lift it to a prime, because those are re-descriptions of the same token-and-issuer structure rather than new substrates exercising a substrate-independent signature; where there is no copyable artifact and no issuer who could call authority back (reputation, soft power), revocation has no analog and the term becomes empty metaphor. The tension is between an autonomous named failure state and the parent it instantiates — delegation_of_authority plus a candidate revocation_closure prime — which is what actually generalizes past the artifact. Diagnostic: Resolve toward the parent (delegation of authority / revocation closure) when there is a revocable right but no copyable carrier and issuer; toward named secret sprawl wherever an access-granting artifact, an issuer, and a copy graph that outruns the registry are literally present.

Structural–Framed Character¶

Secret sprawl sits in the mixed band of the structural–framed spectrum, leaning framed — a failure-state diagnostic resting on a genuinely portable graph schema but entirely constituted by human systems of delegated authority. On evaluative_weight it is a fault-diagnosis with a mild danger charge: it names a "failure state" whose payload is lost revocability, so it carries a harm/risk tilt, though its analytic content is neutral-structural (the out-degree of a copy graph, revocation closure) and it relocates the danger from storage hygiene to graph observability rather than convicting any actor. Human_practice_bound is high: the object is an access-granting artifact issued and tracked by an authority — remove the practice of delegated, revocable authority and there is no token, no issuer, no copy graph, and the defining move (revocation) has no referent. Institutional_origin is pronounced: the concept is furniture of authority systems — credential/key management, brokers, capability tokens in the modern case; sealed registers and recall journals in the historical one — artifacts of human institutions, not facts of nature. Vocab_travels fails at the named level (credential taxonomy, rotation-and-broker mechanics, capability tokens have no referent off the access-control substrate), though the abstract copy-graph/revocation-closure structure does lift. On import_vs_recognize the pattern is unusual: within any authority-as-artifact-with-a-central-issuer substrate the mechanism transfers as genuine recognition — building keys, notarial seals, royal signets copied to envoys are co-instances centuries apart, not metaphors — but where no copyable artifact and issuer exist (reputation, soft power) it collapses to metaphor, and the substrate-neutral lesson belongs to the parents.

The portable structural skeleton is revocable authority bound to a copyable carrier whose copying outpaces the issuer's index — carried by delegation_of_authority (authority granted along paths that go uncatalogued) plus a candidate revocation_closure prime (for any granted right, can the authority reach every place it now acts, in bounded time?), with escape_and_leakage / containment marking the contrast (the perimeter is intact; the holder set multiplied inside it). That skeleton is genuinely substrate-general across authority systems and is exactly what secret sprawl instantiates, keyed to access-control tokens; the cross-domain reach belongs to those parents, while the credential-and-broker machinery stays home. Its character: an analytically-framed, institution-constituted security failure state with a mild danger charge, structural in its copy-graph/revocation-closure kernel — which transfers as mechanism across every authority-token substrate — yet pinned by its access-control vocabulary and the issuer-and-artifact configuration it presupposes.

Structural Core vs. Domain Accent¶

This section decides why secret sprawl is a domain-specific abstraction and not a prime — a subtle case, because its mechanism transfers intact even to building keys and royal signets, yet those are re-descriptions of one authority-token structure rather than a substrate-independent signature.

What is skeletal (could lift toward a cross-domain prime). Strip the access-control apparatus and a thin relational structure survives: a revocable right is bound to a copyable carrier issued by a central authority expected to track its holders; each copy is cheap to make and often invisible to the issuer, so the holder set outruns the issuer's index, and the ability to withdraw the right everywhere it now acts — in bounded time — collapses because the copy set is not enumerable. The abstract pieces are a copyable carrier of authority, an issuer with a registry, a copy graph whose out-degree is the danger, a cheap-copy/costly-revoke asymmetry, and a revocation-closure property that fails when edges go unrecorded. That skeleton is genuinely substrate-portable — it is carried by delegation_of_authority (authority granted along paths that go uncatalogued) plus a candidate revocation_closure prime (can the authority reach every place a right now acts, in bounded time?), with escape_and_leakage / containment marking the contrast that the perimeter is intact while the holder set multiplied inside it. But it is the core secret sprawl shares with those parents, not what makes it the distinctive thing it is.

What is domain-bound. What makes it secret sprawl in particular is information-security furniture that does not survive extraction. The carrier is a credential — password, API key, signing key, session secret, certificate, encryption key; the copy events are commits to Git, CI env-vars, container images, Slack pastes, laptop clones; the issuer is IAM with its principal registry; the withdrawal operation is rotation; the remedies are the specific mechanics of short-lived auto-rotating tokens, a credential broker minting fresh tokens at use, and capability tokens surviving partial-graph revocation; the exemplars are the leaked AWS key and the CircleCI incident. The decisive test: remove the access-control substrate and there is no secret sprawl — the credential taxonomy, rotation-and-broker mechanics, and copy-graph custodian edges have no referent. Notably, even the genuine co-instances (building keys with re-keyable cores, notarial seals with recall journals, royal signets copied to envoys) are the same authority-as-artifact-with-a-central-issuer machinery in different clothing, not new substrates — so the term's breadth is one structure re-described, and where the machinery is absent (reputation, soft power, with no copyable artifact and no issuer who can call authority back) the defining move — revocation — has no analog and the term becomes empty metaphor.

Why this does not clear the prime bar. A prime's vocabulary travels and its cross-domain transfer is recognition of the same mechanism, not analogy. Secret sprawl's transfer is unusual: mechanically intact across every authority-token substrate, yet still below the bar. Within information security it travels as full mechanism — the copy-graph reframing, the revocation-closure diagnostic, the fan-out repricing, the super-linear rotation-cost prediction, and the three-way bounding menu apply identically across all credential classes. Across other authority-artifact systems (building keys, seals, licensing, credentialing, historical statecraft) it still transfers as genuine mechanism — but note the diagnostic point: these are co-instances of one domain-specific pattern, re-descriptions of the same token-and-issuer structure, not independent substrates exercising a substrate-independent signature, which is exactly why the breadth does not lift it to a prime. Beyond copyable-artifact-with-an-issuer substrates it fails entirely, collapsing to metaphor. So when the bare structural lesson genuinely is needed cross-domain — govern whether a granted right can be reached and withdrawn everywhere it acts, in bounded time — it is already carried, in more general form, by delegation_of_authority and the candidate revocation_closure (with the escape_and_leakage / containment contrast). The cross-domain reach belongs to those parents; "secret sprawl," as named, is the sharp access-control specialization whose credential-and-broker machinery should stay home.

Relationships to Other Abstractions¶

Current abstraction Secret Sprawl Domain-specific

Parents (2) — more general patterns this builds on

Secret Sprawl presupposes Delegation of Authority Prime

Secret Sprawl presupposes delegated authority because the credential is a copyable carrier through which an issuer lets holders exercise access rights on its behalf.
Secret Sprawl presupposes Revocation Closure Prime

Secret Sprawl is the credential-copy failure in which the actual live effect set outruns the issuer's invalidation paths and Revocation Closure collapses.

Hierarchy paths (5) — routes to 4 parentless roots

Secret Sprawl → Delegation of Authority → Authority

Show alternative paths (4)

Not to Be Confused With¶

Data breach / leak / exfiltration. The exit of protected data through an unintended pathway — the perimeter is penetrated and something escapes. Secret sprawl is the pre-leakage state: nothing exited, the credential was dispersed inside the trust boundary among legitimate holders, and the binding failure is the inability to recall it, not the fact of exit. Tell: did protected material cross the perimeter to an unauthorized party (breach/leak), or did a sanctioned credential multiply into more stores than the issuer tracks with nothing having left (sprawl)?
A weak or compromised secret. A credential that is low-entropy, guessable, or already known to an attacker — a confidentiality failure. Secret sprawl is orthogonal: a long, high-entropy, perfectly secret credential is fully sprawled the moment its copies outrun the registry. The defect is collapsed revocability, not weak secrecy, and hardening the token does nothing for it. Tell: is the worry that the secret could be guessed or is already known (strength/confidentiality), or that authority cannot be withdrawn in bounded time however strong the secret is (sprawl)?
Insecure secret storage. The problem of a credential sitting in plaintext, an unhardened vault, or a misconfigured store — a property of one location. Secret sprawl is a property of the copy graph: a perfectly hardened primary store with an unenumerable set of copies is exposed, and a small fully-observed graph is safe even if no single store is specially hardened. Tell: is the question whether one location is locked down (storage), or whether every place the token can act is known and deactivatable in bounded time (sprawl)?
Escape-and-leakage / containment failure (the parent contrast). The generic pattern of a constrained quantity exiting through an unintended pathway, or a breached perimeter. Secret sprawl is the deliberate contrast the entry draws: the perimeter is intact and nothing escaped — the holder set multiplied inside it, making withdrawal rather than exit the failure. Tell: is the failure a quantity crossing a boundary it should not (escape/containment), or authority becoming unrecallable because its copies proliferated within the boundary (sprawl)?
Credential stuffing / password reuse. The attack pattern where adversaries replay leaked username-password pairs across many services, exploiting users who reuse one password everywhere. Secret sprawl concerns one credential legitimately copied into many storage locations and holders by the organization itself, collapsing revocability from the inside. Tell: is the issue attackers reusing a leaked credential across sites (credential stuffing, an external attack), or one sanctioned credential fanned out into many internal stores (sprawl)?
Delegation of authority + revocation closure (the parents). The substrate-neutral pattern secret sprawl instantiates: a revocable right granted along paths that go uncatalogued, and the property of whether the issuer can reach every place the right now acts, in bounded time. These parents — not "secret sprawl" — carry the lesson to substrates with a revocable right but no copyable carrier and issuer (where revocation still has meaning). Tell: with no copyable artifact and no issuer who can call authority back, the recurring content is delegation_of_authority / revocation_closure; "secret sprawl" applies only where an access-granting artifact, an issuer, and a copy graph that outruns the registry are literally present. (Treated fully in an earlier section.)

Neighborhood in Abstraction Space¶

Secret Sprawl sits in a sparse region of the domain-specific corpus (62^nd percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Unclustered & Miscellaneous (309 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12