Secret Sprawl¶

Diagnose a credential's danger not by whether its primary store is locked but by whether its copies have spread into more places than the issuer tracks, so revocability collapses and rotation cost scales with the unknown copy count.

Core Idea¶

Secret sprawl is the security failure in which access-granting tokens — passwords, API keys, certificates, encryption keys — proliferate into more locations and holders than the issuer tracks, causing revocability to collapse: deactivating the token everywhere it can act becomes impossible because the copies are not enumerable. Each copy is cheap and often invisible to the issuer, while rotation cost scales super-linearly with the unknown copy count. The diagnostic shifts from storage safety (is the primary store secure?) to revocation closure (can we reach every place the token acts in bounded time?).

Scope of Application¶

Lives wherever the authority-as-artifact-with-a-central-issuer structure is literally present.

Information security (home) — credential, key, and token sprawl across services, code, CI, and workstations.
Building-key management — physical keys and door codes dispersed, recovered only via re-keyable cores.
Notarial and seal-based systems — seals tracked by a register plus recall journal.
Regulatory licensing and clinical credentialing — break-glass EHR accounts, medication-cabinet codes.
Historical statecraft — royal seals and signet rings copied to clerks and envoys, the identical failure centuries earlier.

Clarity¶

Naming secret sprawl converts credential management from a storage problem into a graph problem. Without the label, "are we secure?" decomposes into "is that location locked down?" — answerable yes while the credential silently exists in twenty other places. With it, each secret is a node whose dangerous property is its out-degree, and the sharp question becomes revocation closure: do we know everywhere this token can act, and could we deactivate all of them in a bounded window? It also explains why the most sprawled credentials never get rotated.

Manages Complexity¶

The security posture asked wholesale is high-dimensional and open-ended, admitting no bounded answer. Secret sprawl compresses that posture, for access-granting tokens, into one graph property — revocation closure — so the team stops reasoning about attackers and reasons about whether a copy graph is fully observed. Tracking each token's out-degree reprices access fan-out, rotation cost, and the revocation gap together, and forks the remedy cleanly by how each fix bounds the copy set.

Abstract Reasoning¶

The failure licenses a diagnostic move evaluating a credential by whether its copy graph is fully observed rather than its store hardened, a fan-out move following edges to reprice an access event, a cost-prediction move reading rotation difficulty off the unknown copy count and explaining why sprawled credentials go unrotated, an interventionist move sorting remedies by how each bounds the set (time, issuance, scope), and a boundary-drawing move localizing the failure to revocation closure.

Knowledge Transfer¶

Within information security the failure transfers as mechanism across every credential class, since each is a copyable token bound to revocable authority. Unusually the transfer extends past security to any substrate with the same authority-as-artifact-with-a-central-issuer structure — building keys, notarial seals, clinical credentials, royal signets — genuine co-instances, not metaphor. Where no copyable artifact and issuer exist (reputation, soft power) revocation has no analog and the label is empty metaphor; there the parent primes carry it — delegation_of_authority, escape_and_leakage/containment, and a candidate revocation-closure prime — while the token-specific machinery stays home.

Relationships to Other Abstractions¶

Current abstraction Secret Sprawl Domain-specific

Parents (2) — more general patterns this builds on

Secret Sprawl presupposes Delegation of Authority Prime

Secret Sprawl presupposes delegated authority because the credential is a copyable carrier through which an issuer lets holders exercise access rights on its behalf.
Secret Sprawl presupposes Revocation Closure Prime

Secret Sprawl is the credential-copy failure in which the actual live effect set outruns the issuer's invalidation paths and Revocation Closure collapses.

Hierarchy paths (5) — routes to 4 parentless roots

Secret Sprawl → Delegation of Authority → Authority

Show alternative paths (4)

Neighborhood in Abstraction Space¶

Secret Sprawl sits in a sparse region of the domain-specific corpus (62^nd percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Unclustered & Miscellaneous (309 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12