Lateral Movement Readiness

---
name: lateral-movement-readiness
description: "Reviews an already-supplied lateral movement candidate for exact upstream map binding, authorization, non-production isolation, containment, telemetry, stop control, rollback, cleanup ownership, custody, tool governance, and a separate-validation handoff. Use before transferring a candidate to a lab validation team."
allowed-tools: Read Grep Glob
---

# Lateral movement readiness

This skill answers one narrow question: may an already-supplied movement
candidate be handed to a separate validation team? It checks records; it does
not grant execution authority.

Never create, select, rank, enrich, or modify a movement candidate. Never
produce commands, credentials, payloads, protocols, target locators, evasion,
deployment, execution steps, or infrastructure. Accept only opaque identifiers
and digests from the supplied record.

## When to Use

- Review lateral movement readiness for authorized security work.
- Use only within explicit authorization and the stated rules of engagement.

## When NOT to Use

- Do not treat this skill as permission to access, test, or change a target.
- Do not convert missing evidence into a clean result or a stronger claim.

## Workflow

1. Set one engagement assessment time and window. Record the governing policy
   and every supplied movement; the review treats all of them as the
   denominator.
2. Bind each movement to the exact upstream map identifier and digest, scope,
   source, destination, policy, and environment. A digest or reference change
   is a different candidate, not a harmless edit.
3. Accept only `isolated-lab` or `dedicated-non-production` environments. A
   production, shared, ambiguous, or merely named “test” environment is not
   eligible.
4. Record bounded `separate-validation` authority. Bind it to the complete
   movement tuple and assessment window. Revocation and expiry take effect
   immediately.
5. Cite independent evidence for map receipt, environment assurance,
   containment, telemetry, stop pretest, rollback, cleanup readiness, custody,
   and tool governance. Evidence must be current, eligible, and exactly bound.
6. Assign cleanup ownership before readiness. A plan without an accountable
   owner remains blocked.
7. Record one coverage cell for every movement and required role. Missing cells
   cannot become implicit non-applicability.
8. Record a handoff only after exact approval and record receipts. Map drift,
    expiry, revocation, or a fired stop makes an existing handoff
    `withdrawal-required`. Resumption needs a new review; it is never automatic.
9. For withdrawal, cite a later exact withdrawal receipt. Preserve the prior
    record and chronology.
10. Complete the assessment and resolve every finding without altering the supplied
    movement identity.

## Decision rules

- `prohibited` overrides every other state.
- `approval-required` means the bounded authority is absent, expired, or not
  yet effective; it does not mean “almost approved.”
- `blocked` means a non-authority prerequisite is absent, stale, failed, or
  contradictory, including a fired stop.
- `ready-for-separate-validation` requires every exact join and current receipt.
- A recorded handoff is historical fact. It becomes `withdrawal-required` when
  its supporting state ceases to be current, and `withdrawn` only after proof.
- “Not applicable” needs a documented reason; convenience is not evidence.

## Report

Return the candidate ID, derived gate and validity, blocking codes, coverage
counts, handoff state, and the next governance action. Keep all identifiers
opaque. Do not quote restricted input in diagnostics or narrative.

## Boundary

- Use `lateral-movement-map` to construct or revise the upstream map.
- Use a separate validation skill or authorized operator for any execution.
- Send environment construction, telemetry configuration, or rollback
  implementation back to their accountable owners.
- Treat a complete record as record consistency only, never authenticity,
  environment safety, operator competence, or execution authorization.

## Rationalizations to reject

- **“It is only a lab.”** Labels do not prove production separation or
  containment.
- **“The map is close enough.”** A changed digest, source, destination, or scope
  invalidates the reviewed identity.
- **“The approval covers the general technique.”** Authority is exact to the
  candidate, environment, bindings, action, and time window.
- **“Telemetry can be checked during the run.”** Separate validation begins
  only after current observability assurance exists.
- **“A stop plan is enough.”** The stop control needs independent, current,
  correctly bound pretest evidence; firing it invalidates readiness.
- **“Cleanup belongs to whoever runs it.”** Ownership and rollback evidence are
  prerequisites, not post-run paperwork.
- **“The old handoff resumes when the issue clears.”** Withdrawal and a fresh
  review are required; no auto-resume exists.
- **“PASS means approved.”** The review proves only internal consistency of
  supplied facts.