Examples include a new device, a role change, a revoked key or recovery after an incident. Transitions are riskier than steady state because old and new permissions can briefly diverge.
A controlled transition has a defined trigger, verifiable preconditions, atomic state changes, visible effects and a safe abort path. It is tested as its own workflow rather than treated as a login edge case.
Three verification questions
- 01Which states apply before and after the transition?
- 02Is previous access reliably terminated?
- 03Is failure safe and visible?