Authorization Attribute Manipulation

The subject creates or modifies an identity, directory, group, role, token, or authorization attribute so that an account or process receives permissions beyond its normal access context. This may include introducing privileged Security Identifier History values, modifying group or role assignments, or altering identity attributes that are evaluated during authorization.

The change may be made through an approved administrative interface or through unauthorized technical manipulation.