What it means
Cloud identity boundary validation tests whether accounts, subscriptions, projects, tenants, organizations, roles, and trust relationships enforce the intended separation of duties and blast radius.
Why it matters
Administrative inheritance and federation can create cross-boundary access that is not visible from a single resource or policy.
Practical focus
- Document intended trust and administrative boundaries
- Test cross-account and cross-tenant assumptions
- Review inherited and delegated privileges
- Monitor changes to trust relationships
Common mistakes
- Assuming account separation guarantees identity separation
- Ignoring shared identity providers and automation
- Reviewing only normal user access
- Failing to test emergency and support paths
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: