Preparation
Archive Data
Authorization Token Staging
Boot Order Manipulation
CCTV Enumeration
Circumventing Security Controls
Data Obfuscation
Data Staging
Delegated Preparation via Artificial Intelligence Agents
Device Mounting
Email Collection
External Media Formatting
File Download
File Exploration
Hardware-Based Remote Access (IP-KVM)
Impersonation
Increase Privileges
IT Ticketing System Exploration
Joiner
Media Capture via External Device
Mover
Network Scanning
On-Screen Data Collection
Oversight Circumvention and Control Degradation
Persistent Access via Bots
Physical Disk Removal
Physical Exploration
Physical Item Smuggling
Private / Incognito Browsing
Read Windows Registry
Remote Desktop (RDP)
Security Software Enumeration
Social Engineering (Outbound)
Software Installation
- Installation of Dark Web-Capable Browsers
- Installing Browser Extensions
- Installing Browsers
- Installing Cloud Storage Applications
- Installing FTP Clients
- Installing Messenger Applications
- Installing Note-Taking Applications
- Installing RDP Clients
- Installing Screen Sharing Software
- Installing SSH Clients
- Installing Virtual Machines
- Installing VPN Applications
Software or Access Request
Suspicious Web Browsing
Testing Ability to Print
VPN Usage
- ID: PR037
- Created: 25th March 2026
- Updated: 25th March 2026
- Contributors: The ITM Team, João Rodrigues,
Oversight Circumvention and Control Degradation
A subject weakens, bypasses, or manipulates oversight mechanisms designed to enforce validation, accountability, and governance over sensitive actions. These mechanisms include peer review processes, approval workflows, and segregation of duties, which collectively function to detect error, prevent misuse, and ensure independent verification.
This behavior does not constitute harm in itself but modifies the control environment in advance of an infringement, reducing the likelihood that subsequent actions are scrutinized, challenged, or blocked.
Subsections (5)
| ID | Name | Description |
|---|---|---|
| PR037.004 | Approval Workflow Exploitation | A subject exploits weaknesses, gaps, or edge cases within formal approval workflows to obtain authorization with reduced scrutiny, while remaining within the defined process.
This includes manipulating workflow conditions such as approval thresholds, conditional routing logic, exception handling paths, or automated approval mechanisms. The subject leverages the rules and structure of the workflow itself, enabling actions to progress through approval channels with minimal or superficial validation.
The defining characteristic of this behavior is that the oversight mechanism is engaged, but its effectiveness is reduced through exploitation of process logic.
Although the subject appears to comply with formal procedures, the intent of the control is undermined. Actions that would typically require independent review or deeper scrutiny are approved with limited challenge, increasing the risk of unauthorized or harmful outcomes. |
| PR037.001 | Oversight Control Bypass | A subject executes an action without undergoing required oversight by circumventing, disabling, or otherwise avoiding established approval or validation controls.
This includes actions that bypass mandatory review, approval, or authorization steps that are designed to ensure independent verification before an action is completed. Examples include directly executing controlled actions without triggering required approvals, self-authorizing where independent approval is mandated, or exploiting gaps that allow actions to proceed outside defined control pathways.
The defining characteristic of this behavior is that the oversight mechanism is not engaged at all, resulting in a complete absence of independent scrutiny.
Oversight control bypass undermines critical governance structures intended to prevent unauthorized, erroneous, or harmful activity. By removing these control points, the subject creates conditions in which actions can be performed without challenge, increasing the likelihood that subsequent infringement occurs undetected. |
| PR037.002 | Review Condition Manipulation | A subject influences the human conditions under which review occurs to reduce scrutiny or increase the likelihood of approval.
This includes strategic selection of reviewers, timing of submissions to coincide with reduced staffing or attention, or structuring work in a manner that limits reviewer engagement or visibility. The subject acts unilaterally to shape who reviews, when review occurs, and how attention is applied, without altering the formal workflow itself.
The review process remains intact in form, but its effectiveness is degraded through contextual manipulation. This creates an appearance of compliance while reducing the likelihood that issues are identified or challenged. |
| PR037.005 | Reviewer Collusion or Reciprocity | A subject engages in coordinated behavior with one or more individuals to ensure approval of actions without meaningful scrutiny.
This includes reciprocal approval arrangements, patterned interactions where individuals consistently approve each other’s actions, or implicit agreements to avoid challenge or escalation. The behavior may be explicit or emerge over time through repeated interaction patterns, resulting in a breakdown of independent validation.
The defining characteristic of this behavior is multi-subject coordination, where oversight is degraded through collective alignment rather than unilateral action.
Although formal review or approval processes remain in place, their integrity is compromised by the absence of genuine independence. Over time, this behavior can normalize superficial validation practices within a group, embedding weakened oversight into routine operations and increasing exposure to undetected infringement. |
| PR037.003 | Segregation of Duties Circumvention | A subject consolidates control authority by obtaining, retaining, or exploiting permissions that allow them to perform multiple stages of a controlled process without independent oversight.
This includes scenarios where the subject holds or acquires overlapping roles that are intended to remain separate, such as the ability to request and approve actions, initiate and authorize transactions, or develop and deploy changes. The behavior may arise from misconfigured access controls, privilege accumulation over time, or informal deviations from defined role boundaries.
The defining characteristic of this behavior is the structural collapse of role separation, where control mechanisms designed to enforce independence are no longer effective.
By eliminating separation between responsibilities, the subject creates conditions in which actions can be completed without challenge or verification. This removes a foundational safeguard against error, misuse, and unauthorized activity, significantly increasing the likelihood that subsequent infringement can occur undetected. |