# Exploitability Model

Stave classifies findings into severity tiers based on both the
individual control and the compound chains it participates in.

## Individual findings

Each control carries a severity (critical, high, medium, low, info)
derived from the security property it verifies and the blast radius
of a violation.

## Compound elevation

When a finding participates in a compound chain and all chain
prerequisites are satisfied, the finding's effective severity may
be elevated. A medium IAM finding becomes critical when it enables
a complete privilege escalation path.

## Exploitability annotations

`stave apply` output includes chain membership and exploitability
status for each finding, showing whether the finding is:
- Part of a chain where all prerequisites fired (exploitable)
- Part of a chain where some prerequisites fired (one-away)
- Standalone (no chain context)

## Commands

```bash
stave catalog --kind chain --chains internal/chains --controls internal/controls --verbose     # see all chains and severity
```

```bash
stave apply --observations testdata/e2e/e2e-01-violation/observations  # findings include chain annotations
```