Trust lifecycle

One incident, real fixture data: vouched, compromised, revoked — not the whole fleet.

32affected descendants
3 / 5departments touched
575unrelated preserved

replay the incident — same lineage Dependency Map traces

vendor_portal — vouched to revoked

Vouched
2026‑07‑30, day 1
Compromised
2026‑08‑14, day 16
15 days of accumulated propagation before detection

Hollow ring = revocation, applied the moment trust was pulled. Replay removes 0 further records — idempotent.

what the same compromise costs, by response

Purge the whole app
600 / 600
Purge every department that used it
600 / 600
Custody: revoke exact descendants
40 / 600
Records / 600 total. Flattering case (tool used by 5/5 depts) — see sensitivity below.

sensitivity — the same comparison, by how widely the tool was trusted

departments reachedpurge-by-user destroysCustody destroysCustody saves
1 / 520%1%19%
2 / 540%3%37%
3 / 560%4%56%
4 / 580%5%75%
5 / 5100%7%93%
scripts/cost.py — even at the narrowest reach, 20× overkill.