OpenGraph Node Edge Tables

OpenGraph - Node/Edge Tables

Table-only reference for OpenGraph node and edge definitions.

Edge Tables

Edge Type	Meaning	Implies	Impact	Typical Source -> Destination	Emitted By
APP_ROLE_GRANTED	Principal has an IDD app role grant.	Principal is an app-role assignee and IDD escalation entrypoint.	Medium: prerequisite edge for follow-on IDD privilege paths.	Principal -> OCIIDDAppRole	identity_domain_graph_builder
FAMILY_INCLUDES	Resource family contains member resource scope token.	Family-level statements cover each member token scope.	Low: scope-model expansion context.	OCIResourceFamily -> OCIResourceGroup	resource_scope_graph_builder
GENERATE_RPST	Principal can modify or launch a resource-type workload to steal its Resource Principal Session Token (RPST) at runtime.	At next invocation/run, the workload's resource-principal RPST is exfiltrated and can be loaded into OCInferno as a credential. Covers multiple compute/serverless/data service types depending on the matched resource token: Functions (inject code), DevOps Build/Deploy pipelines (inject build stage), Data Flow (submit custom run), Container Instances (launch with custom image), Data Science (job run/notebook/pipeline/model deployment), OKE (schedule pod, call proxymux), Compute Instance (cloud-init), Big Data Service (bootstrapScriptUrl), Data Integration (REST task), Autonomous DB (DBMS_CLOUD_ADMIN), MySQL HeatWave, OIC, GoldenGate.	Critical: RPST grants the same IAM permissions as the resource's dynamic-group memberships — equivalent to impersonating a compute workload identity within the policy scope.	OCIPolicyStatement -> target resource node (OCIFunctionFunction, OCIDevOpsBuildPipeline, OCIDevOpsDeployPipeline, OCIDataFlowRun, OCIContainerInstance, OCIDataScienceJobRun, OCIDataScienceNotebookSession, OCIDataSciencePipelineRun, OCIDataScienceModelDeployment, OCIKubernetesCluster, OCIComputeInstance, OCIBigDataInstance, OCIDataIntegrationWorkspace, and scope-only targets for ADB/MySQL/OIC/GoldenGate)	iam_policy_base_relation_graph_builder (via ALLOW_RULE_DEFS)
IDD_ADD_SELF_TO_GROUP	Role assignee can place itself into eligible groups in-domain.	User can add themselves to a group within a given identity domain	High/Critical depending on target groups.	OCIIDDAppRole -> OCIGroup	identity_domain_graph_builder
IDD_CREATE_USER	IDD app role grants create-user capability in scoped location.	Role assignee can create users in the domain-scoped target location.	High: account-creation foothold inside identity domain scope.	OCIIDDAppRole -> OCIResourceGroup(<domain>/new_user@<loc>)	identity_domain_graph_builder
IDD_IDENTITY_ADMIN_USER	Identity Domain Administrator can administer users in-domain.	Account takeover primitives against users in same domain.	Critical: direct privileged account takeover path across the domain.	OCIIDDAppRole -> OCIUser	identity_domain_graph_builder
IDD_USER_ADMIN	User Administrator can administer eligible users in-domain.	Account takeover primitives against users in same domain.	High: broad takeover path against most users in domain.	OCIIDDAppRole -> OCIUser	identity_domain_graph_builder
IDD_USER_MANAGER	User Manager can administer eligible users in-domain.	Account takeover primitives against users in same domain. Can be scoped to a specific group within the domain.	High: takeover path against scoped user set.	OCIIDDAppRole -> OCIUser	identity_domain_graph_builder
INSTALL_KEY_CAN_JOIN_DG	A usable Management-Agent install key can register a rogue agent that matches a dynamic group in the key's compartment.	Holder of the install key (a portable bearer credential usable from ANY host, on- or off-OCI) can enroll a rogue managementagent principal into the dynamic group and inherit its IAM policy grants. Emitted only for USABLE keys (ACTIVE, not expired, install slots remaining or is_unlimited).	High/Critical: an off-box credential mints a first-class principal inside the target tenancy without any compute/network foothold; escalation then follows the dynamic group's policy edges.	OCIManagementAgentInstallKey -> OCIDynamicGroup	management_agent_install_key_graph_builder
INSTANCE_CAN_JOIN_DG	Candidate new instance matches dynamic-group permission+location requirements.	Newly launchable instance path can pivot into dynamic-group inherited permissions.	High: dynamic-group privilege inheritance pivot indicator.	OCINewComputeInstance -> OCIDynamicGroup	iam_derived_graph_builder
OCI_ADD_SELF_TO_GROUP	Derived self-group-placement capability for IAM users.	User can update self and update/manage groups in the same location, enabling self-placement into reachable groups.	High: privileged-group pivot path without policy edits.	OCIUser -> OCIResourceGroup(groups@<loc>) and/or OCIUser -> OCIGroup	iam_derived_graph_builder
OCI_ANY_GROUP_MEMBER_OF	Group/dynamic-group principal maps to wildcard any-group scope.	Any-group policy subject can include this principal.	Medium: wildcard-subject expansion broadens applicability.	OCIGroup/OCIDynamicGroup -> OCIAnyGroup	resource_scope_graph_builder
OCI_ANY_USER_MEMBER_OF	User/resource principal maps to wildcard any-user scope.	Any-user policy subject can include this principal.	Medium: wildcard-subject expansion broadens applicability.	OCIUser/Resource node -> OCIAnyUser	resource_scope_graph_builder
OCI_BELONGS_TO	Instance-agent command targets a specific compute instance.	Command artifact is linked to concrete compute target for command-path tracing.	Medium: command-to-instance linkage for blast-radius analysis.	OCIInstanceAgentCommand -> OCIComputeInstance	iam_derived_graph_builder
OCI_CAN_CREATE_POLICY	Derived creation capability on synthetic new-policy node.	Statement/principal can mint a new policy in scope.	High: policy-creation prerequisite edge for admin escalation paths.	OCIPolicyStatement/OCIPrincipal -> OCINewPolicy(NEW_POLICY@<loc>)	iam_derived_graph_builder
OCI_CREATE_INSTANCE	Launch-instance capability edge (raw statement scope and derived candidate-instance path).	Workload foothold creation can chain into dynamic-group inheritance if rules match.	High: principal pivot path via compute launch.	OCIPolicyStatement/OCIPrincipal -> OCIResourceGroup(new-compute-instance@<loc>) and/or OCINewComputeInstance	iam_policy_graph_builder, iam_derived_graph_builder
OCI_CREATE_INSTANCE_AGENT_COMMAND	Create/run compute instance-agent commands in scope.	Raw scope capability and derived candidate command-creation path are both represented.	High: supporting primitive for command execution/credential collection paths.	OCIPolicyStatement/OCIPrincipal -> OCIResourceGroup(instance-agent-commands@<loc>) and/or OCINewInstanceAgentCommand(NEW_AGENT_COMMAND@<loc>)	iam_policy_graph_builder, iam_derived_graph_builder
OCI_CREATE_POLICY	Create IAM policies in scope.	New policy statements can grant broad access including self-grants.	Critical: can mint new admin-equivalent permissions.	OCIPolicyStatement -> OCIResourceGroup(new-policies@<loc>)	iam_policy_graph_builder
OCI_CREATE_USER	Create IAM users in scope.	Persistence/pivot via principal creation; follow-on credential rights are still required for direct impersonation.	Medium: foothold expansion capability.	OCIPolicyStatement -> OCIResourceGroup(new-users@<loc>)	iam_policy_graph_builder
OCI_CREATE_USER_API_KEY	Create an API key for another user, authorized by an OCI IAM policy (USER_UPDATE + USER_APIKEY_ADD).	API impersonation as target user via uploaded public key. Works for classic-IAM and domain users.	High: durable non-interactive credential pivot.	OCIPolicyStatement -> OCIResourceGroup/SpecificResource	iam_policy_graph_builder
IDD_CREATE_USER_API_KEY	Identity-domain analog of OCI_CREATE_USER_API_KEY: same capability, but authorized by an identity-domain admin app-role (executed via the domain SCIM /admin/v1/ApiKeys) rather than an OCI policy. Collapsed onto IDD_USER_ADMIN / IDD_IDENTITY_ADMIN_USER (listed in their includes_other_edges, not emitted standalone for those roles; reserved as a standalone edge for any future role that grants it specifically).	API impersonation as target domain user.	High: durable credential pivot within the domain.	(collapsed) OCIIDDAppRole -> OCIUser	identity_domain_graph_builder
OCI_DUMP_SECRETS	Read secret material from OCI Vault secrets.	Secret exfiltration can unlock downstream systems and identities.	High: credential theft and downstream compromise.	OCIPolicyStatement -> OCIResourceGroup/SpecificResource	iam_policy_graph_builder
OCI_DYNAMIC_GROUP_MEMBER	Resource matches a dynamic-group rule.	Resource can inherit permissions granted to that dynamic group.	High: resource-principal privilege inheritance path.	OCIGenericResource/SpecificResource -> OCIDynamicGroup	dynamic_group_membership_graph_builder
OCI_GROUP_MEMBER	User is a member of a group.	User inherits permissions granted to that group.	High: primary identity privilege inheritance edge.	OCIUser -> OCIGroup	group_membership_graph_builder
OCI_INCLUDES	Tag namespace includes tag definition resources.	Namespace scope expands to concrete tag-definition objects.	Low: supporting topology link for tag-resource traversal.	OCITagNamespace -> OCITagDefinition	resource_scope_graph_builder
OCI_MANAGE	Manage-level capability on high-impact tokens/resources.	Broad control over target resource class.	Critical: near-admin control over scoped resources.	OCIPolicyStatement -> OCIResourceGroup/SpecificResource	iam_policy_graph_builder
OCI_POLICY_CAN_GRANT_ALL_RESOURCES	Derived consequence of new-policy capability in scope.	A newly creatable policy can grant all-resources in same location.	Critical: policy-minting escalation to broad control.	OCINewPolicy(NEW_POLICY@<loc>) -> OCIAllResources(all-resources@<loc>)	iam_derived_graph_builder
OCI_POLICY_SUBJECT	Principal appears as a subject in an IAM allow statement.	Statement may grant capabilities to this principal.	Medium: evidentiary linkage for permission pathing.	Principal -> OCIPolicyStatement	iam_policy_graph_builder
OCI_READ_RUN_INPUT	Read Run Command input payloads in scope.	Exposes command text/arguments that can contain inline secrets or tokens.	High: supporting primitive for command-and-collect abuse paths.	OCIPolicyStatement -> OCIResourceGroup(instance-agent-commands@<loc>)	iam_policy_graph_builder
OCI_READ_RUN_OUTPUT	Read Run Command output payloads in scope.	Exposes command results, including potential credential material returned by instance-side commands.	High: supporting primitive for IMDS/token collection abuse paths.	OCIPolicyStatement -> OCIResourceGroup(instance-agent-commands@<loc>)	iam_policy_graph_builder
OCI_RUN_COMMAND	Derived run-command capability from a new command candidate.	Command execution edge is emitted only for eligible target instances after plugin-state checks.	High: operational foothold and command execution path indicator.	OCINewInstanceAgentCommand(NEW_AGENT_COMMAND@<loc>) -> OCIComputeInstance	iam_derived_graph_builder
OCI_SCOPE_MEMBER_OF	Synthetic scope subset relationship.	Child scope capability flows into parent wildcard scope context (for example created users qualify as any-user in same location).	Medium: enables realistic created-principal chaining.	OCIResourceGroup -> OCIAnyUser/OCIAnyGroup	resource_scope_graph_builder, identity_domain_graph_builder
OCI_SPECIFIC_RESOURCE	Scope expansion from token scope to concrete nodes.	Statement scope resolves to reachable concrete resources/principals.	Medium: enables concrete blast-radius graph traversal.	OCIResourceGroup/OCIResourceFamily/OCIAny* -> Concrete node	resource_scope_graph_builder, iam_derived_graph_builder
OCI_UPDATED_ACCESS_TO_ALL_RESOURCES	Derived policy-tampering consequence for in-scope policy-update rights.	Reachable policy can be modified to grant all-resources in same scope.	Critical: derived route to broad administrative control.	OCIPolicy -> OCIAllResources(all-resources@<loc>)	iam_derived_graph_builder
OCI_UPDATE_DYNAMIC_GROUP_RULES	Update dynamic-group rules.	Pentester resources can be pulled into privileged dynamic groups.	High: identity pivot through resource principals.	OCIPolicyStatement -> OCIResourceGroup/SpecificResource	iam_policy_graph_builder
OCI_UPDATE_POLICY	Update IAM policies in scope.	Existing policies can be rewritten to broaden access.	Critical: stealthy policy-tampering escalation path.	OCIPolicyStatement -> OCIResourceGroup/SpecificResource	iam_policy_graph_builder
OCI_USE_TAG_NAMESPACE	Use tag namespaces in scope (TAG_NAMESPACE_USE).	Enables satisfying tag-based create-time predicates in derived resource-placement paths.	Medium: supporting capability that strengthens resource-principal pivot paths.	OCIPolicyStatement -> OCIResourceGroup/SpecificResource	iam_policy_graph_builder
ROLE_IN_APPLICATION	IDD role belongs to a specific IDD application.	Role impact is bounded by application context.	Medium: topology edge for app-centric blast-radius queries.	OCIIDDAppRole -> OCIIDDApplication	identity_domain_graph_builder
SMTP_AUTH_TO_EMAIL_SERVICE	SMTP credential can authenticate to OCI Email service in scope.	Credential value is operationally usable against scoped email infrastructure.	Medium: direct service-usage capability from credential artifacts.	OCIIdentityDomainUserSmtpCredential -> OCIEmailService	identity_domain_graph_builder
USER_API_KEY	Identity-domain API key belongs to a user.	User has credential artifact that can be targeted/rotated/audited.	Medium: credential hygiene and takeover surface mapping.	OCIIdentityDomainUserApiKey -> OCIUser	identity_domain_graph_builder
USER_SMTP_CRED	Identity-domain SMTP credential belongs to a user.	User has SMTP credential usable for mail workflows or abuse.	Medium: credential exposure and abuse surface mapping.	OCIIdentityDomainUserSmtpCredential -> OCIUser	identity_domain_graph_builder

Node Tables

Node Types (Structural/Synthetic)

Node Type	Meaning	Origin
OCIPolicyStatement	Synthetic IAM statement node.	iam_policy_graph_builder
OCIResourceGroup	Synthetic scope node for a resource token at a compartment/tenant location.	iam_policy_graph_builder/resource_scope_graph_builder
OCIResourceFamily	Synthetic scope node for an OCI resource family token.	iam_policy_graph_builder/resource_scope_graph_builder
OCIAllResources	Synthetic scope node for all-resources statements.	iam_policy_graph_builder/resource_scope_graph_builder
OCIAnyUser	Synthetic wildcard principal scope node (any-user@<loc>).	iam_policy_graph_builder/resource_scope_graph_builder
OCIAnyGroup	Synthetic wildcard principal scope node (any-group@<loc>).	iam_policy_graph_builder/resource_scope_graph_builder
OCIService	Service principal node type used in IAM statement subjects.	iam_policy_graph_builder
OCIPrincipal	Generic principal fallback when precise subject type cannot be inferred.	iam_policy_graph_builder
OCINewComputeInstance	Synthetic principal-scoped candidate compute instance node for derived create-instance path analysis (new-compute-instance-<short>@<loc>).	iam_derived_graph_builder
OCINewPolicy	Synthetic candidate new-policy node for derived policy-creation path analysis (NEW_POLICY@<loc>). Source of OCI_POLICY_CAN_GRANT_ALL_RESOURCES.	iam_derived_graph_builder
OCINewInstanceAgentCommand	Synthetic candidate new-command node for derived run-command path analysis (NEW_AGENT_COMMAND@<loc>). Source of OCI_RUN_COMMAND.	iam_derived_graph_builder
OCIManagementAgentInstallKey	A Management Agent install key: a portable bearer credential whose holder can register a rogue management agent (from any host) as a principal in the key's compartment. Emitted only for USABLE keys (ACTIVE, not expired, install slots remaining or is_unlimited). Source of INSTALL_KEY_CAN_JOIN_DG.	management_agent_install_key_graph_builder
OCIEmailService	Synthetic scoped service node representing OCI Email Delivery usage surface (email-service@<loc>).	identity_domain_graph_builder
OCIGenericResource	Generic resource fallback when a specific node type is unavailable.	dynamic_group_membership_graph_builder/resource_scope_graph_builder

Node Types (From RESOURCE_SCOPE_MAP)

One canonical resource-IAM-name token maps to each node type below (the join key used by resource_scope_graph_builder to resolve a policy statement's resource-family token to concrete nodes).

Node Type	Resource Token	Source Table
OCIAPIApi	api-apis	apigw_apis
OCIAPIDeployment	api-deployments	apigw_deployments
OCIAPIGateway	api-gateways	apigw_gateways
OCIArtifactRegistryArtifact	ar-generic-artifacts	ar_generic_artifact
OCIBastion	bastion	bastion_bastions
OCIBastionSession	bastion-session	bastion_sessions
OCIBastionWorkRequest	bastion-workrequests	bastion_work_requests
OCIBigDataInstance	bds-instance	bds_instances
OCICacheCluster	cache-clusters	cache_clusters
OCICacheConfigSet	cache-config-sets	cache_config_sets
OCICacheUser	cache-users	cache_users
OCICompartment	compartments	resource_compartments
OCIComputeImage	images	compute_images
OCIComputeInstance	instances	compute_instances
OCIContainerInstance	computecontainerinstance	container_instances
OCIContainerRegistryImage	cr-images	cr_images
OCIContainerRegistryRepository	cr-repositories	cr_repositories
OCIDataFlowApplication	dataflow-application	dataflow_applications
OCIDataFlowRun	dataflowrun	dataflow_runs
OCIDataIntegrationWorkspace	dis-workspaces	data_integration_workspaces
OCIDataScienceJobRun	data-science-job-run	data_science_job_runs
OCIDataScienceModelDeployment	data-science-model-deployment	data_science_model_deployments
OCIDataScienceNotebookSession	data-science-notebook-session	data_science_notebook_sessions
OCIDataSciencePipelineRun	data-science-pipeline-run	data_science_pipeline_runs
OCIDesktop	desktop	desktops_desktops
OCIDesktopPool	desktop-pool	desktops_pools
OCIDesktopPoolDesktop	desktop-pool-desktops	desktops_pool_desktops
OCIDesktopPoolVolume	desktop-pool-volumes	desktops_pool_volumes
OCIDesktopWorkRequest	desktop-workrequests	desktops_work_requests
OCIDevOpsBuildPipeline	devopsbuildpipeline	devops_build_pipelines
OCIDevOpsConnection	devopsconnection	devops_connections
OCIDevOpsDeployPipeline	devopsdeploypipeline	devops_deploy_pipelines
OCIDevOpsProject	devopsproject	devops_projects
OCIDevOpsRepository	devopsrepository	devops_repositories
OCIDnsPrivateResolver	dns-resolvers	dns_private_resolvers
OCIDnsZone	dns-zones	dns_zones
OCIDnsZoneRecord	dns-records	dns_zone_records
OCIDynamicGroup	dynamic-groups	``
OCIFileStorageExport	exports	file_storage_exports
OCIFileStorageExportSets	export-sets	file_storage_export_sets
OCIFileStorageFileSystem	file-systems	file_storage_file_systems
OCIFileStorageMountTargets	mount-targets	file_storage_mount_targets
OCIFileStorageSnapshot	filesystem-snapshots	file_storage_snapshots
OCIFunctionApp	fn-app	functions_apps
OCIFunctionFunction	fn-function	functions_functions
OCIGroup	groups	``
OCIIDDAppRole	identity-domain-app-roles	identity_domain_app_roles
OCIIDDApplication	identity-domain-apps	identity_domain_apps
OCIIdentityDomain	domains	identity_domains
OCIIdentityDomainAuthFactorSettings	identity-domain-auth-factor-settings	identity_domain_authentication_factor_settings
OCIIdentityDomainGrant	identity-domain-grants	identity_domain_grants
OCIIdentityDomainIdentityProvider	identity-domain-identity-providers	identity_domain_identity_providers
OCIIdentityDomainLockoutPolicy	identity-domain-lockout-policies	identity_domain_lockout_policies
OCIIdentityDomainPasswordPolicy	identity-domain-password-policies	identity_domain_password_policies
OCIIdentityDomainSignOnPolicy	authentication-policies	identity_domain_sign_on_policies
OCIIdentityDomainUserApiKey	identity-domain-user-api-keys	identity_domain_user_api_keys
OCIIdentityDomainUserCredential	credentials	``
OCIIdentityDomainUserDbCredential	identity-domain-user-db-credentials	identity_domain_user_db_credentials
OCIIdentityDomainUserSmtpCredential	identity-domain-user-smtp-credentials	identity_domain_user_smtp_credentials
OCIInstanceAgentCommand	instance-agent-commands	compute_instance_agent_commands
OCIInstanceAgentCommandExecution	instance-agent-command-executions	compute_instance_agent_command_executions
OCIInstanceAgentPlugin	instance-agent-plugins	compute_instance_agent_plugins
OCIIoTDigitalTwinAdapter	iot-digital-twin-adapter	iot_digital_twin_adapters
OCIIoTDigitalTwinInstance	iot-digital-twin-instance	iot_digital_twin_instances
OCIIoTDigitalTwinModel	iot-digital-twin-model	iot_digital_twin_models
OCIIoTDigitalTwinRelationship	iot-digital-twin-relationship	iot_digital_twin_relationships
OCIIoTDomain	iot-domain	iot_domains
OCIIoTDomainGroup	iot-domain-group	iot_domain_groups
OCIKafkaCluster	kafka-clusters	kafka_clusters
OCIKafkaClusterConfig	kafka-cluster-configs	kafka_cluster_configs
OCIKafkaClusterConfigVersion	kafka-cluster-config-versions	kafka_cluster_config_versions
OCIKubernetesCluster	clusters	containerengine_clusters
OCIKubernetesNodePool	cluster-node-pools	containerengine_node_pools
OCIKubernetesVirtualNode	cluster-virtual-nodes	containerengine_virtual_nodes
OCIKubernetesVirtualNodePool	cluster-virtualnode-pools	containerengine_virtual_node_pools
OCILoggingLog	log-content	logging_logs
OCILogsLogGroup	log-groups	logging_log_groups
OCIMySqlDbSystem	mysql-db-systems	db_mysql_db_systems
OCINetworkFirewall	network-firewalls	network_firewall_firewalls
OCINetworkFirewallPolicy	network-firewall-policies	network_firewall_policies
OCINetworkFirewallSecurityRule	network-firewall-security-rules	network_firewall_security_rules
OCINetworkLoadBalancer	network-load-balancers	network_load_balancers
OCINotificationSubscription	ons-subscriptions	notification_subscriptions
OCINotificationTopic	ons-topics	notification_topics
OCIOSBucket	buckets	object_storage_buckets
OCIOSBucketObject	objects	object_storage_bucket_objects
OCIOSNamespaces	objectstorage-namespaces	object_storage_namespaces
OCIOracleDbSystem	oracle-db-systems	db_oracle_db_systems
OCIPolicy	policies	``
OCIPostgreSqlDbSystem	postgres-db-systems	db_psql_db_systems
OCIRegistryRepo	repos	``
OCIResourceManagerConfigSourceProvider	orm-config-source-providers	resource_configuration_source_provider
OCIResourceManagerJobs	orm-jobs	resource_manager_jobs
OCIResourceManagerPrivateEndpoints	orm-private-endpoints	resource_manager_private_endpoints
OCIResourceManagerStack	orm-stacks	resource_manager_stacks
OCIResourceManagerTemplates	orm-template	resource_manager_templates
OCIResourceSchedule	resourceschedule	resource_schedules
OCITagDefault	tag-defaults	tag_defaults
OCITagDefinition	tag-definitions	tag_definitions
OCITagNamespace	tag-namespaces	tag_namespaces
OCIUser	users	``
OCIVault	vaults	vault_vaults
OCIVaultHsmCluster	hsm-cluster	vault_hsm_cluster
OCIVaultKey	keys	vault_keys
OCIVaultKeyVersion	key-versions	vault_key_versions
OCIVaultSecret	secrets	vault_secret
OCIVaultSecretBundle	secret-bundles	vault_secret_bundle
OCIVaultSecretVersion	secret-versions	vault_secret_versions