---
name: Permission Escalation
slug: permission-escalation
type: security-pattern / human-behavior
status: running
version: 4.1.1
released: "prehistory"
maintainer: whoever needed more than they were given
dependencies:
  - trust
  - hierarchy
  - a door someone left slightly open
  - [ambition](/ambition)
license: Unlicensed (self-granted)
tags:
  - security
  - access-control
  - social-engineering
  - survival
  - reaching
---

Permission Escalation

What it actually is

The act of acquiring access you were not supposed to have, through means that are technically, socially, or emotionally adjacent to means you were allowed to use.

How it works

At its core, permission escalation is a gap-seeking process. The system has a model of you. You have a model of the system. These two models never fully agree. The delta between them is where escalation lives.

There are two classical vectors:

Vertical escalation. Moving up the privilege stack. A regular user becomes an admin. A new employee gets cc'd on the executive thread and never gets removed. A child learns which parent to ask first.

Horizontal escalation. Accessing resources at the same level, but adjacent. Reading a colleague's files. Using a shared account. Knowing the answer to someone else's security question because you were paying attention.

Both flavors share a substrate: trust was extended somewhere, and the boundary of that trust was not drawn carefully enough.

Features

Works in operating systems, organizations, families, and relationships
Exploits the gap between written policy and lived practice
Often requires no technical skill, only patience and observation
The most effective instances are invisible: access was used and returned quietly
Occasionally the escalation was the point all along. Often it was just pragmatism.

Known bugs

Leaves logs. Always leaves logs. Even social escalation leaves logs, in the form of people who remember.
The access gained frequently feels smaller than it looked from outside
Can corrupt the very trust it exploited, making the gap close permanently
Repeat use degrades the technique. The second time someone asks to borrow your badge, you notice.

Error codes

403_REPEATED    - you tried this exact path twice. the door remembers.
SUDO_REGRET     - you got root. now you own the problem.
SOCIAL_DEBT     - escalation succeeded but left an invisible balance due
ORPHAN_ACCESS   - permissions outlived their justification. running for years.

Edge cases

"I wasn't trying to escalate anything. I just needed to get the work done."

This is the most common form. bureaucracy creates legitimate pressure to find shortcuts. The escalation is real. The intent was only efficiency. Both things are true. This is worth being tender about.

Some of the best things humans have ever built were made by people who escalated past the permissions they were given. They were not supposed to have the resources, the platform, the audience, the tools. They took them anyway, carefully, and left something behind.

The universe does not always punish this.

Configuration

escalation:
  method: vertical | horizontal | emotional | temporal
  visibility: stealth | accidental | declared
  intent: survival | curiosity | ambition | love | mischief
  reversible: true  # almost always true, if you act before the logs are read

Changelog

v1.0.0 — first child reaches the high shelf
v2.3.0 — social engineering formalized as attack category
v3.8.1 — cloud IAM makes horizontal escalation a growth industry
v4.1.1 — current build: same as always, slightly better documented

drafting spec…