Trust Transitivity Breakpoint Review¶
Procedure — instantiates Associative Transfer Warrant Audit
Identifies where trust, reputation, or certification stops transferring across a dependency or intermediary chain and renewed verification is required.
Trust Transitivity Breakpoint Review is the chain-structured member of the family. Its defining insight is that trust is not transitive — A trusting B and B trusting C does not entail A trusting C — so when reputation or certification is inherited down a dependency, supply, or intermediary chain, there is some hop where it stops carrying and renewed verification becomes mandatory. The procedure walks the chain hop by hop and finds that breakpoint. Unlike siblings that ask whether one link is warrant-bearing, this one asks where along a series the warrant runs out, because the danger in chains is not a single bad link but the assumption that a trusted brand at the top blesses everything hanging beneath it.
Example¶
A security team is vetting an npm package their app has started depending on, "trusted" because it is published under the scope of a well-known open-source organization. The review builds the chain: reputable org → the maintainer account that published this package → the specific package → its transitive dependencies → the build server that signs releases. For each hop it records the vouching role, the warrant channel, and a strength rating.
The org's reputation is strong — but the review asks what it actually covers. The breakpoint appears fast: the package in question is a community side-project living under the org's scope, not one of its audited flagship libraries, so the org halo does not reach it. Two hops further down, the strength drops again — two transitive dependencies are maintained by anonymous accounts with no signing and no audit. A stale release signature on a third adds a decay flag. The verdict is not "trusted" or "untrusted" but a located breakpoint: pin and independently audit those two transitive deps; the org's vouching stops at its flagship boundary.
How it works¶
- Build the chain explicitly, including the transitive hops that are easy to forget (a dependency's dependencies, a vendor's subcontractor, a citation's source).
- For each hop record three things: the role (who vouches for what, for whom), the warrant channel (cryptographic signature, third-party audit, brand reputation, personal acquaintance), and a strength rating.
- Mark the first hop where channel strength drops below the required bar — that is the breakpoint, the point where inherited trust must be replaced by fresh verification.
- Apply decay — a stale signature or an aged audit weakens a hop even if it was once strong.
Tuning parameters¶
- Chain depth — how many hops to trace before stopping. Deeper traces catch buried risk but cost effort and hit hops you cannot inspect.
- Required-trust bar — the minimum channel strength a hop must clear to pass trust along. A high bar forces more re-verification.
- Strength scale — how finely each hop's trust is rated. Graded scales locate the breakpoint precisely; coarse ones are faster.
- Staleness window — how quickly a certification or signature decays to "must renew." Short windows are safer but noisier.
When it helps, and when it misleads¶
Its strength is catching the "trusted brand nearby, therefore trusted" error wherever chains hide it — dependencies, vendors, sub-processors, citations, signed artifacts. It operationalizes the security principle that trust is not transitive, made explicit in models like PGP's web of trust.[n1]
Its failure mode is that chains can be deep and partly invisible — the transitive dependency you never see is exactly where the break hides — and a single overlooked hop defeats the whole review; meanwhile, re-verifying every hop everywhere is prohibitively costly, so the procedure must ration scrutiny and can ration it wrong. The classic misuse is the confused-deputy pattern: treating a trusted intermediary's endorsement as automatically covering everything downstream of it. The guarding discipline is to default to "trust stops here" at every hop unless a live channel is affirmatively shown, rather than assuming continuity.
How it implements the components¶
source_target_role_map— maps each hop's vouching role, making explicit who certifies what for whom along the chain.warrant_channel_separation— labels each hop's channel (signature, audit, reputation, brand) so genuine warrant is told apart from mere association.scope_decay_and_distance_boundary— accounts for chain distance and certification staleness in how far trust legitimately reaches.association_strength_indicator— rates each hop's trust strength, which is how the breakpoint is located.
It does not name a discrete property and record a decision (the Association-to-Evidence Matrix), weigh reputational harm (the Guilt-by-Association Review), or stage an adversarial refutation (the Associative Claim Red Team).
Related¶
- Instantiates: Associative Transfer Warrant Audit — this procedure finds where inherited trust stops traveling.
- Sibling mechanisms: Association-to-Evidence Matrix · Guilt-by-Association Review · Halo and Taint Decomposition Table · Contact/Contagion Warrant Test · Endorsement Scope Checklist · Category-Membership Attribution Audit · Associative Claim Red Team
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Trust Transitivity Breakpoint Review operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it identifies where trust, reputation, or certification stops transferring across a dependency or intermediary chain and renewed verification is required.
Independent corroboration: The frozen evidence defines Trust Transitivity Breakpoint Review as 'Identifies where trust, reputation, or certification stops transferring across a dependency or intermediary chain and renewed verification is required', so its operative form is Assessment, Review & Assurance.
Nearest alternative: Analysis, Modeling & Optimization — Trust Transitivity Breakpoint Review includes features of an analytical, modeling, inference, comparison, or optimization procedure that derives insight or a solution, but its defining operation is a bounded evaluation of existing evidence or work that produces a finding or disposition.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Security Studies & Intelligence Analysis
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Universal
Rationale: Trust transitivity breakpoint review is rooted in adversarial security, trust, integrity, and incident response; historically, that field developed the core operation described here: identifies where trust, reputation, or certification stops transferring across a dependency or intermediary chain and renewed verification is required.
Related originating lineages:
- Computer Science & Software Engineering — Software systems, algorithms, and data structures supplies a distinct formative lineage for the mechanism's trust transitivity breakpoint review logic.
- Law & Governance — Legal doctrine, regulatory governance, and procedural accountability supplies a parallel or contributing lineage for the mechanism's defining operation: identifies where trust, reputation, or certification stops transferring across a dependency or intermediary chain and renewed verification is required.
- Sociology & Anthropology — Sociology and anthropological study of institutions and social relations supplies a parallel or contributing lineage for the mechanism's defining operation: identifies where trust, reputation, or certification stops transferring across a dependency or intermediary chain and renewed verification is required.
Review resolution: The blind reviewers agree that security_intelligence is the primary origin and differ only on alternate origin disagreement, origin mode disagreement, domain reach disagreement, encyclopedia synthesis disagreement. I preserve every independently explained alternate from both records rather than imposing a numeric cap. I retain cross_disciplinary_synthesis because the combined evidence shows material contributions from several lineages. The broader reach of universal records portability separately from historical provenance; encyclopedia_synthesis=true preserves the affirmative synthesis judgment where either reviewer identified one.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; medium confidence.
Notes¶
[n1] A core security principle holds that trust is not transitive: A trusting B and B trusting C does not entail A trusting C. PGP's web of trust makes the non-transitivity explicit by requiring each party to set its own trust in introducers rather than inheriting it automatically down a chain. ↩