Glossary
Privilege Escalation
Privilege escalation is a principal ending up with more access than they were originally granted, whether through a software bug, a misconfiguration, or a deliberate attack that chains together several smaller flaws to reach a broader outcome than any single flaw would allow on its own. The end state looks the same regardless of cause — an account or process with more authority than it should have — but the path to get there varies widely, which is part of why it's hard to defend against with any single control.
Detecting escalation after the fact, rather than only trying to prevent it in the first place, means monitoring for a principal's effective access actually changing unexpectedly — a comparison between what a principal is supposed to hold and what they're actually able to do, checked on an ongoing basis rather than assumed to stay in sync once granted correctly.