Root Patterns

R-HuuD

Finds a Human interactively amending Data, where this is expressed as a single relationship.
R-HuirPaD+eUI

Finds Human interacting (possibly remotely) with a process that amends (creates and receives) data, and enables user input of the data.
R-HuirPcD

Finds Human interacting (possibly remotely) with a process that creates data.
R-HuirPeID

Finds a human interacting (possibly remotely) with a process that enables user entry of some Data.
R-HuirPeOD

Finds a human interacting (possibly remotely) with a process that enables user access to some Data.
R-HuirPeUD

Finds a human interacting (possibly remotely) with a process that enables user update of some Data.
R-HuirPrD

Finds Human interacting (possibly remotely) with a process that receives data.
R-HuirPsD

Finds Human interacting (possibly remotely) with a process that serves data. This conflicts with domain model assumptions.
R-HuvD

Finds a Human viewing Data.
R-RDuHP

Finds a Host running a Process used remotely by a Remote Desktop client.
R-PaD

Finds a Process that is amending data, using separate creates and receives links in case they were added separately.
R-PaDH

Finds a Host running a Process that is amending data.
R-PcDH

Finds a Host running a Process that is creating data.
R-PpD+noDU

Finds a Process that is processing Data, where the Process has a self-referential noDU link indicating it should not be processing data.
R-PrDH

Finds a Host running a Process that is receiving data stored on the same host.
R-HuirIPpD

Finds Human interacting (possibly remotely) with an Interactive Process that processes data.
R-RDuRDuS

Finds a remote desktop using remotely another remote desktop which is using remotely a third process.
R-RDuRTuS

Finds a remote desktop using remotely a remote terminal which is using remotely a third process.
R-HuWES

Finds a Human using a web browser to access email.
R-HuirIPaD

Finds Human interacting (possibly remotely) with an Interactive Process that amends data.
R-HuirErD

Finds Human interacting (possibly remotely) with an Editor process that receives data.
R-HD

Finds Data stored at a Host.
R-CP

Finds a solo Console Process.
R-D

Finds a solo Data asset.
R-HuirEcD

Find a Human interacting (possibly remotely) with an Editor that creates Data.
R-HHuWE

Finds a Human using both an email client and a web browser on the same host.
R-HHuWSMS

Finds a Human using both an SMS client and a web browser on the same host.
R-HIP

Finds a solo interactive process and its host.
R-HPrD

Finds a Process relaying Data and the process host.
R-HuaD

Finds a Human interactively amending Data.
R-HuaDPH

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, and the process Host.
R-HPsD

Finds a Process serving Data and the process host.
R-HuaID

Finds a Human interactively entering Data, where this is expressed as a single relationship and labelled as having been asserted.
R-HuiRACHSPiD

Finds a user entering data via remote interaction with a process using a remote access client on a console host located in a space.
R-HuaDRAC

Finds a Human interacting with Data remotely via a Remote Access Client.
R-HuiDPH

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, and the process Host.
R-HuiD

Finds a Human entering Data.
R-HuiPiDCHS

Finds a user interacting directly with a process to enter data using a console host located in a space.
R-HuHWES

Finds a Human using a web browser running on a host to access email.
R-HuaVD

Finds a Human interactively viewing Data, where this is expressed as a single relationship and labelled as having been asserted.
R-HuaUD

Finds a Human interactively amending Data, where this is expressed as a single relationship and labelled as having been asserted.
R-HuiCHDtS

Finds a human interacting with a console host and a desktop service running on a possibly remote host.

R-Pod

Finds a solo Pod.
R-KPxCuuSI

Finds a Client using a Service that runs in a Container, whose Pod is connected via a Subnet to a K8 Master that runs a K8s Ingress proxy.
R-KPxMLnSA

Finds a Client using a Remote Access Service that runs on and controls a K8s Master node, connected to a Subnet and running a K8s API Server.
R-KPxWLnSA

Finds a Client using a Remote Access Service that runs on and controls a K8s Worker node, connected via a Subnet to a Master that runs a K8s API Server.
R-MWHLS

Finds K8s Master and Worker nodes on the same (cluster) host, and connected to the same subnet.
R-MWPodLS2

Finds a Pod running on a K8s Worker connected via a Logical Subnet to a K8s Master, which can also access an overlay on the Logical Subnet.
R-PodCnD

Finds Data stored on a Container provisioned by a Pod.
R-KPxCuScP

Finds a Pod managed by K8S or equivalent, hosting an unprivileged service in a Container, which controls another service accessed by a client. This means the client will need to access to Service in its Container for authentication purposes.
R-PodCnPD

Finds a Container running a Process that handles Data stored on the associated Pod.
R-PodDCC

Finds a Pod managed by a Data Centre that has a Cluster.
R-PodDCMC

Finds a K8s Pod managed by a Data Centre that has a Cluster with a K8s Master.
R-PodHaH

Finds a Pod provisioned by a Host that is above another Host.
R-PodHhPH

Finds a Pod provisioned by a Host that has a PhysicalHost.
R-PodP

Finds a Pod containing a Process.
R-PodCnP

Finds a Process hosted by a Container provisioned by a Pod.
R-KPxCLnSA

Finds a Client using a Remote Acces Service that runs in and controls a Container, whose Pod is connected via a Subnet to a K8S Master that runs a K8s API Server.
R-HumPC

Finds a Container running a Process managed by a Human.
R-KPxCaaSI

Finds a Client using for authentication a Service that runs in a Container, whose Pod is connected via a Subnet to a K8 Master that runs a K8s Ingress proxy.
R-KPxCazSI

Finds a Client using for authorization a Service that runs in a Container, whose Pod is connected via a Subnet to a K8 Master that runs a K8s Ingress proxy.
R-Ct

Finds a solo Container.
R-CtDS

Finds a Container that stores a copy of Data (which is actually not allowed).
R-CtHaH

Finds a Container provisioned by a Host that is above another Host.
R-CtHhPH

Finds a Container provisioned by a Host that has a PhysicalHost.
R-DCCM

Finds a Data Centre with a Cluster on which is provisioned a Pod management Master node.
R-DCCMCAP

Finds a process controlling a data centre hosting a K8s master node running a K8s API server and Ingress proxy.
R-CtH

Finds a container provisioned by a Host.
R-DCMW

Finds a K8s Master and Worker on the same (cluster) Host in a Data Centre.
R-DCPHM

Finds a Cloud (e.g. K8s) Master node whose physical host is in a Data Centre.
R-DCPHW

Finds a Cloud (K8s) Worker whose physical host is in a Data Centre.
R-HCt

Finds a host provisioned by a container.
R-KIP

Finds an Ingress proxy mediating access to a service.
R-DCCt

Finds a Container managed directly by a Data Centre.

R-HuWSMSDF

Finds a Human using a web browser and an SMS client on the same host, accessing URLs from SMS messages via the browser.
R-PDF

Finds a Data Flow protected by keys from a vault, plus the data flow source and destination processes. The destination process is matched twice so it can be referred to in either role.
R-PDADFO

Finds a Process that sends a Data Flow to a destination process in the direction of a data store or source, plus the associated Data and Data Access assets. The source of the flow is matched twice, so it can be referred to by either role name.
R-PDADFI

Finds a Process that sends a Data Flow to a destination process in the direction of a data consumer, plus the associated Data and Data Access assets. The Process is matched twice, so it can be referred to by either role name.
R-PDADAV

Finds a Process creating a data asset controlled by a vault.
R-PcPuDS

Finds two processes accessing the same stored copy of data, one of which reads the data (processes it as a necessary input).
R-PcPrDS

Finds two processes accessing the same stored copy of data, one of which receives the data (processes it as an input).
R-PcDSH

Finds a Process that is creating data of which there is a copy stored on the same host.
R-PaDSH

Finds a Process that is amending data of which there is a copy stored on the same host.
R-HuWESDF

Finds a Human using a web browser to access email, including URLs contained in emails.
R-HuirPiD

Finds Human interacting (possibly remotely) with and entering Data via a Process.
R-HuirPvDS

Finds a (possibly remote) user of an interactive process that views data loaded by the process from a local data copy.
R-HuirPvDF

Finds a (possibly remote) user of an interactive process that views data received by the process in a data flow.
R-HuirPvD

Finds a (possibly remote) user of an interactive process that views data created by the process.
R-HuirPiDS

Finds a (possibly remote) user of an interactive process that inputs data stored from the process in a local data copy.
R-HuirPiDF

Finds a (possibly remote) user of an interactive process that inputs data sent from the process in a data flow.
R-PDFDI

Finds a data flow to a process that uses the data as input. The Process is matched twice, so it can be referred to by either role name.
R-HuirPD

Finds a Human interacting (possibly remotely) with a Process that is using Data.
R-HuiRACvDFCHS

Finds a user interacting directly with a process to view data using a remote access client on a console host located in a space.
R-HuiPvDFCHS

Finds a user interacting directly with a process to view data using a console host located in a space, where the data comes from an inbound data flow.
R-HuiPvDCHS

Finds a user interacting directly with a process to view data using a console host located in a space.
R-HuWEDF

Finds a Human using a web browser and an email client on the same host, accessing URLs from emails via the browser.
R-PDFFA

Finds a Data Flow, its source and destination processes, and a related data access element at the source.
R-PDP

Finds a Process that implicitly or explicitly serves Data.
R-PDFODADFO

Finds a Process that receives a flow of Data from the direction of a data producer, and forwards it towards a data store. The Process is matched twice, so it can be referred to by either role name.
R-HuiDSPH

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host.
R-StoPDA

Finds the Operator of a Process that accesses Data.
R-SDUDSDA

Finds a Service enabling access for a Data Use, where the Service reads from a local Data Copy.
R-SDUDADS

Finds a Service enabling access for a Data Use, where the Service writes to a local Data Copy.
R-ScDSPDIcD

Finds a Data Asset controlled by a vault which is input to a Process that creates output.
R-ScDSPDADD

Finds a Data Asset controlled by a vault which is inbound to a Process and used to fulfil another outbound Data Asset.
R-ScDDPDADS

Finds a Data Asset controlled by a vault which is outbound from a Process and fulfilled by another inbound Data Asset.
R-RUODI

Finds a Process that enables remote user output.
R-RUIDO

Finds a Process that enables remote user input.
R-PuDFDI

Finds a data flow to a process that needs the data as input.
R-PDFIDADFI

Finds a Process that receives a flow of Data from the direction of a data store, and forwards it towards a data consumer. The Process is matched twice, so it can be referred to by either role name.
R-PsDSH

Finds a Process serving Data of which there is a copy stored on the same host.
R-PrDSH

Finds a Process that is receiving data of which there is a copy stored on the same host.
R-PpDADA

Finds a Process processing data to create a data asset.
R-PIP

Finds a Process that uses Data as input with no other source than a locally stored copy (so access to the data is represented by an Input Pool rather than a Data Input).
R-PHHDS

Finds a Physical Host located in a Space, plus data stored on the host or on a virtual host running there.
R-PDR

Finds a Process acting as a Data Relay.
R-PDOScDD

Finds a Data Asset controlled by a vault which is output from a Process.
R-PDO

Finds a Process that creates Data as output, or gets it from an interactive user.
R-PDIDDF

Finds a Process using Data as input that contains a Data Field.
R-PDI

Finds a Process that uses Data as input, or displays it to an interactive user.
R-PDFV

Change from: Finds a Data Flow protected by keys from a vault, plus the data flow source and destination processes. The destination process is matched twice so it can be referred to in either role.
R-PSDP

Finds a Process that serves stored Data.
R-HuaDSPH

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host.
R-ScDSPDI

Finds a Data Asset controlled by a vault which is input to a Process.
R-HPsDPDSDF

Finds a Host that stores a copy of Data served by and sent from a Process on the same Host, plus the associated Data Flow and Data Access.
R-HPDAdDS

Finds a Host running a Process that CRUD deletes locally stored Data.
R-HPDAcDS

Finds a Host running a Process that CRUD creates locally stored Data.
R-HDSV

Finds a copy of Data encrypted with a key from a vault, stored on a Host, and its Physical Host.
R-HDS

Finds a stored copy of Data on a Host, and its Physical Host.
R-HDCDF

Finds a Data Flow for which there is a Data Cache on the Host of a sending or receiving process.
R-HDBsDV

Finds a Host running a Database process that serves a stored DataCopy encrypted with keys from a vault, and the associated DataPool.
R-HDBsD

Finds a Host running a Database process that serves a stored DataCopy, and the associated DataPool.
R-HDBDSDF

Finds a Host running a DB process acting as a Stored Data Pool for a Data Flow to a destination process.
R-HDBDRDF

Finds a Host running a DB process acting as a Data Relay for a Data Flow to a destination process.
R-DSPDFVDB

Finds a DB serving data obtained via a data flow from a remote data store, where the stored data is encrypted with keys from a vault.
R-HPDADF

Finds a Host running a Process that sends a Data Flow to a destination process, plus the associated Data and Data Access assets.
R-DSPDFDB

Finds a DB serving data obtained via a data flow from a remote data store.
R-DCDFcV

Finds a Data Flow controlled by a key Vault for which there is a Data Cache.
R-DBsDRDF

Finds a DB serving data that is stored on a separate Host and supplied to the DB in a data flow.
R-DBsDADA

Finds a DB processing queries to create a data asset.
R-DAVPDA

Finds a Process consuming a data asset controlled by a vault.
R-DAPpDA

Finds a Process processing data using a data asset.
R-HPuDSDI

Finds a stored data input needed by a process, plus the process and data host.
R-DADU

Finds a service controlling access to a data access, which fulfils a data use.
R-DADS

Finds a Data Access fulfilling a Data Copy.
R-DADBsDA

Finds a DB processing data queries using a data asset.
R-CSDFDA2

Finds two process participating in a data flow.
R-DSDA

Finds a Data Access fulfilled by a Data Copy.
R-HPDADS

Finds a Host storing a Data Copy fulfilled by a local process.
R-DUDA

Finds a service controlling access to a data access, which is fulfilled by a data use.
R-HPDADSDU

Finds a Host storing a Data Copy fulfilled by a Data Access that sources data from a Data Update (from a process on any Host).
R-HPDADS2DO

Finds a Host running a Process that writes to a local stored Data Copy, and sources data from two data producers.
R-HPrpDS

Finds a host running a Process with read access (crudr) to a locally stored data copy, which it also processes, plus the data access asset representing the data deserialization.
R-HPrDS

Finds a host running a Process with read access (crudr) to a locally stored data copy, plus the data access asset representing the data deserialization.
R-HPeD

Finds a Host for a Process that appends to locally stored Data.
R-HPDSrDI

Finds a Host running a Process that CRUD reads a locally stored copy of Data it uses as input.
R-HPDS-fDI

Finds a Host with a stored Data Copy, running a Process that has a Data Input asset for the same Data that may or may not be fulfilled by the stored Data Copy.
R-HPDSDI

Finds a stored data input to a process, plus the process and data host.
R-HPDSDADF

Finds a Host storing a Data Copy that is read and sent in a data flow by a Process on the same Host.
R-HPDSDA

Finds a Host storing a Data Copy that fulfils a Data Access for a Process on the same Host.
R-HPDS

Finds a Host running a process that stores a local copy of some data.
R-HPdpDS

Finds a host running a Process with write/delete access (crudd) to a locally stored data copy, which it also processes, plus the data access asset representing the data deserialization.
R-HPsDPDFDS

Finds a Host that stores a copy of Data served by and sent to a Process on the same Host, plus the associated Data Flow and Data Pool.
R-HPDODS

Finds a Host running a Process that creates locally stored Data which it produces as output.
R-HPDOuDS

Finds a Host running a Process that CRUD updates locally stored Data which it produces as output.
R-HPDDR

Finds a Host running a Process relaying Data.
R-HPdDS

Finds a host running a Process with write/delete access (crudd) to a locally stored data copy, plus the data access asset representing the data deserialization.
R-HPDFDADS

Finds a Host running a Process that receives an incoming Data Flow and writes the data to local storage. The Process is matched twice, so it can be referred to by either role name.
R-HPDFDAuDS

Finds a Host running a Process that CRUD updates locally stored Data by saving an incoming Data Flow.
R-HPDAuDS

Finds a Host running a Process that CRUD updates locally stored Data.
R-HPDOcDS

Finds a Host running a Process that CRUD creates locally stored Data which it produces as output.
R-HPDOdDS

Finds a Host running a Process that CRUD deletes locally stored Data which it produces as output.
R-HPDODF

Finds a Host running a Process that creates a Data Flow to a destination process, plus the associated Data and Data Output assets.
R-HPDFDI

Finds a Host running a Process that receives an incoming Data Flow and uses it as input. The Process is matched twice, so it can be referred to by either role name.

R-PDODAnDF

Finds a process creating data, the data access asset (a data output), and fulfilled output data asset, where the output asset needs a field.
R-FwdDFf2DP2P

Finds an outbound Data Flow from one (longer) data path to a second (shorter) data path, and a data path which is a subset of the first, and of which the second is a subset, plus the two adjacent processes at the end of that in between data path.
R-FwdDFfDP2P

Finds an outbound (forward) data flow from a process on a data path leading to that process.
R-FwdDFtDP2P

Finds an outbound (forward) data flow to a process on a data path leading to that process.
R-HDS2DPfDA

Finds a Host with a stored copy of data at which there are two processes, one of which writes to the data, and a data source for this.
R-HDSPDIfDA

Finds a data input that is a destination for data from a source and used by a process whose host stores a copy of the data.
R-DSDPS

Finds a data path from a process to a service, where the process is a source of the data.
R-HSDADPDXP

Finds a service with a data access at the end of a data path process that exchanges data with a second process, where both processes have the same Host.
R-HSDADPPDXP

Finds a service with a data access to which there is a data path from a process that exchanges data with a third process, where all three processes have the same Host.
R-PTDR

Finds a temporary data relay asset and the associated process and data.
R-SDADPDXP

Finds a service with a data access at the end of a data path that exchanges data with a second process.
R-RADCSDS

Finds a remote access client acting as a data destination, and having a data channel to a service that can act as a data source.
R-RevDFf2DP2P

Finds an inbound Data Flow from one (longer) data path to a second (shorter) data path, and a data path which is a subset of the first, and of which the second is a subset, plus the two adjacent processes at the end of that in between data path.
R-RevDFfDP2P

Finds an inbound (reverse) data flow to a process on a data path leading to that process.
R-RevDFtDP2P

Finds an inbound (reverse) data flow from a process on a data path leading from that process.
R-SDADPDXPRAC

Finds a service at the end of a data path that exchanges data with a second process, and there is a remote access client using remotely both processes.
R-SDADPDXRAC

Finds a service at the end of a data path that exchanges data with a remote access client.
R-SDADPPDXP

Finds a service with a data access to which there is a data path from a process that exchanges data with a third process.
R-SDADPPDXPRAC

Finds a service with a data access to which there is a data path from a process that exchanges data with a third process, and there is a remote access client using remotely the second and third processes.
R-SDADPPDXRAC

Finds a service with a data access to which there is a data path from a process that exchanges data with a remote access client.
R-DSDDF

Finds a Data Copy of a Data asset containing a Data Field.
R-RADCSDD

Finds a remote access client acting as a data source, and having a data channel to a service that can act as a data destination.
R-DSDCDP2

Finds a Data Source for which there is a Data Channel to a next Process, which uses a Data Path that extends another Data Path to another Process.
R-DC1

Finds a solo Data Channel.
R-DSDAfDD

Finds a Data Destination with a possible data source that itself has a source, and a data channel to the possible data source from a data relay that is also a possible data source.
R-DADSDCSDD

Finds an active data channel carrying a forward flow that ends at a data destination that is itself a data source, and the channel beyond that source to another destination on the same data path that can act as a data destination.
R-DAODADInDF

Finds an output data asset fulfilling (via a data access) an input data asset that needs a field contained in the data.
R-DAOiDADInDF

Finds an output data asset that includes a field contained in the data fulfilling (via a data access) an input data asset that needs the field.
R-DAPDADF

Finds a Process receiving Data that contains a Data Field, via a Data Asset.
R-DSDCDD2P

Finds a Data Source fulfilling a Data Destination, with an active forward data channel to the source and a data channel from the destination, plus the associated processes and data paths.
R-DC2TDRfDP2

Finds an active forward (output) data channel leading to a transparent data relay from which another active channel continues along the same data path.
R-DC2TDRrDP2

Finds an active reverse (input) data channel leading to a transparent data relay from which another active channel continues along the same data path.
R-DC2xrDA2

Finds a reverse Data Channel from a Data Destination that extends another Data Channel to a Data Source.
R-DC3

Finds a data channel that extends a second channel that extends a third channel.
R-DC3xf

Finds an active forward data channel that extends a second channel that extends a third channel (meaning there are transparent relay processes between the channels).
R-DC2xfDA2

Finds a forward Data Channel from a Data Source that extends another Data Channel to a Data Destination.
R-DCDFDF

Finds a Data Flow containing a Data Field for which there is a Data Cache.
R-DP3

Finds a data path which extends a second path which extends a third path.
R-DC3xr

Finds an active reverse data channel that extends a second channel that extends a third channel (meaning there are transparent relay processes between the channels).
R-DODCSDD

Finds a data output process that acts as a data source, and having a data channel to a service that can act as a data destination.
R-DIDCSDS

Finds a data input client acting as a data destination, and having a data channel to a service that may act as a data source.
R-DP1

Finds a solo Data Path.
R-DDDCSDS

Finds a data input client acting as a data destination, with a previously identifed potential data source that has an onward data channel to a service that can act as a data source. Should this be constrained to lie on the same data path?
R-DDDCDS2P

Finds a Data Source fulfilling a Data Destination, with an active reverse data channel to the destination and a data channel from the source, plus the associated processes and data paths.
R-DDDCDP2

Finds a Data Destination for which there is a Data Channel to a next Process, which uses a Data Path that extends another Data Path to another Process.
R-DDDPS

Finds a Data Path from a Process that is a Data Destination to a Service.

R-PrSe

Finds a an IoT Sensor sending data to a Process, along with the onboard simple communication Process and Data.
R-PpSe

Finds a client Process that polls an IoT Sensor, along with its onboard simple communication Process and Data.
R-SHuTh

Finds a Human managing a Space in which a Thing is located.
R-PcSe

Finds a client Process that alters control input to an IoT Sensor, along with its onboard simple communication Process and Data.
R-Se

Finds a solo Sensor.
R-SePD

Finds a Sensor with its onboard process and data.
R-SesD

Finds a Sensor and its sensed Data.
R-PuSe

Finds a client Process that reads data from an IoT Sensor, along with its onboard simple communication Process and Data.
R-PaCo

Finds a client Process that amends an IoT Controller, along with its control input Data and onboard communication Process.
R-PuCo

Finds a client Process that updates an IoT Controller, along with its control input Data and onboard communication Process.
R-HumThP

Finds a Human managing a Thing with an onboard process.
R-HuiThaS

Finds a Human that uses an IoT Thing and has access to a space.
R-HuiSe

Finds the control input and sensed output for an IoT Sensor, which is being used interactively by a Human, plus the interactive process that creates the output.
R-HuiCo

Finds the control input for an IoT Controller, which is being used interactively by a Human.
R-DScSePD

Finds a Sensor with its onboard process and output data, and its stored copy of control input data.
R-DcTh

Finds an IoT Thing and its control input Data.
R-CoPDS

Finds a Controller with its stored control input data.
R-CoPD

Finds a Controller and its control input data.
R-Co

Finds a solo Controller.
R-IoT

Finds a solo IoT Thing. Not used at present, but reserved for a future extension.

R-L1SSg2AC

Finds a gateway between layer 1 subnets (i.e. Bluetooth or USB connections), along with the segment asset representing the path via the gateway, and a context in which the gateway is connected to both subnets.
R-L3cGcL1

Finds a Physical Host gateway on an IP subnet with a paring connection, all in the same space.
R-L3cGrL1

Finds a USB/Bluetooth device connected from an IP subnet to a Host, all in the same space.
R-LTethSg2

Finds a Host connected via a layer 1 subnet (i.e., Bluetooth or USB) connection and a tethered gateway to an IP subnet, plus the forward and reverse path segment via the gateway.
R-LTethSg2AC

Finds a Host connected via a layer 1 subnet (i.e., Bluetooth or USB) connection and a tethered gateway to an IP subnet, plus the forward and reverse path segment via the gateway, and a context in which the gateway is connected to both subnets.
R-LTRevSg2

Finds a Host connected via a layer 1 subnet (i.e., Bluetooth or USB) connection and a reverse tethered gateway to an IP subnet, and the forward path segment via the gateway.
R-LTRevSg2AC

Finds a Host connected via a layer 1 subnet (i.e., Bluetooth or USB) connection and a reverse tethered gateway to an IP subnet, and the forward path segment via the gateway, and a context in which the gateway is connected to both subnets.
R-UHDSrP

Finds Data stored on a USB Device paired with a USB Host running a service for the Data, where the data is used by a Process running on some host.
R-UHS

Finds a USB Host located in a Space.
R-UPcGrUP

Finds a possible USB hub between a USB device and a USB host (it provides the USB Pair from the USB Host).
R-UPrGcUP

Finds a possible USB hub between a USB host and a USB device (it provides the USB Pair from the USB Host).
R-USBD

Finds Data stored on a USB device.
R-L1SSg2

Finds a gateway between layer 1 subnets (i.e. Bluetooth or USB connections), along with the forward and return path segments via the gateway.
R-UHDpP

Finds Data stored on a USB Device paired with a USB Host which is running a process that handles the data.
R-L1rGcL3

Finds a Bluetooth or USB device connected from a host to an IP subnet, all in the same space.
R-UHDrP

Finds Data stored on a USB Device paired with a USB Host, where the data is used by a Process running on some host.
R-HUSBTHS

Finds a Host in a Space that accepts pairing via USB with a TrivialHost.
R-HumTHS

Finds a Human managing a Trivial Host located in a space.
R-HumHUSBTH

Finds a TrivialHost paired via Bluetooth with another host managed by a Human.
R-HumHBTTH

Finds a Human managing a Host paired with a TrivialHost via Bluetooth.
R-HUISG

Finds a pair of hosts pairing via USB, and the space in which they are located.
R-HuiHUSBTH

Finds a Human using a Host paired with a TrivialHost via USB.
R-HuiHBTTH

Finds a Human using a Host paired with a TrivialHost via Bluetooth.
R-HpURH

Finds two Physical Hosts that are paired over USB.
R-HpBRH

Finds two Physical Hosts that are paired over Bluetooth.
R-L1cGcL3

Finds a physical host with a pairing connection that is also connected to an IP subnet, all in the same space.
R-HL1HS

Finds two hosts in a space connected via a Bluetooth or USB pair, and the associated location access contexts.
R-HL1H

Finds two hosts connected via a Bluetooth or USB pair, and the space in which this connection is established.
R-HBTTHS

Finds a Host in a Space that accepts pairing via Bluetooth with a TrivialHost.
R-HBISG

Finds a pair of hosts pairing via Bluetooth in a Space.
R-BPcGcBP

Finds a Bluetooth device paired with two other devices.

R-PMHHS

Finds a Process running on a host whose physical host is a Mobile Console Host, which may be located in a Space.
R-PHS

Finds a Physical Host located in a Space.
R-PHLSS

Finds a host that directly is or indirectly has a physical host in a space and is connected to a logical subnet accessible from that space.
R-PHHS

Finds a host that directly is or indirectly has a physical host in a space.
R-PHHPS

Finds a process running on a host that can be accessed from a space.
R-PHH

Finds a host that directly is or indirectly has a physical host.
R-PH2

Finds a process with two hosts.
R-PH

Finds a solo physical host.
R-PcWH

Finds a WiFiLAN and its local implementation, plus a controlling process.
R-PS

Finds a solo Physical Subnet.
R-PcSHLnS

Finds a Process controlling a Shell Host that runs a Remote Access Service.
R-PCPHLSS

Finds a Process location access context and the related process, host and space and one subnet to which the host is connected. Note that the role names are not the ones usually used because this pattern feeds into a CP where the INS should follow the sequence Host-Process-Subnet.
R-PcLS

Finds a Process that controls a network.
R-PcH

Finds a Process that controls a Host.
R-PccP

Finds two processes, each of which controls the other.
R-PC

Finds a physical cluster host.
R-LnSucP

Finds a remote access service using a process to which it forwards credentials.
R-MHHS

Finds a Host whose physical host is a Mobile Client that may be in a Space.
R-RAC

Finds a remote access client.
R-HuPCH

Finds a Human interacting with a Process running on an Interactive Host.
R-HuRACP

Finds a human interacting with a remote access client on a local host that is remotely using a process.
R-HuSP

Finds a human user interacting with a smartphone.
R-HuwStmH

Finds a Human managing a Host and working for an Employer.
R-HuwStmP

Finds a Human managing a Process and working for an Employer.
R-IcP

Finds a Process controlling an Internet class subnet.
R-Internet

Finds an Internet class network.
R-IpH

Finds a Host providing an Internet class subnet.
R-LnScP

Finds a login service controlling access to a process.
R-LnSuP

Finds a login service using a process.
R-LS

Finds a solo Logical Subnet.
R-HumSH

Finds a Human managing a Shell Host.
R-MHC

Finds a solo Mobile Console Host.
R-MHcIS

Finds a Mobile Console Host in a Public Space connected to the Internet.
R-P

Finds a solo Process.
R-RACuHRASP

Finds a host running a process and a remote access service that uses the process, and is used by a remote access client.
R-StS

Finds a Private Space operated by a Stakeholder.
R-RACuRHRASP

Finds a host running a process and a remote access service that uses the process, where both are used remotely by a remote access client.
R-StHP

Finds a Stakeholder operating a Host that runs a Process.
R-StSPH

Finds a Private Space operated by a Stakeholder where a Fixed Host is located.
R-Sv

Finds a solo Server.
R-TH

Finds a solo trivial host.
R-THGP

Finds a trivial host running a general process.
R-TP

Finds a solo trivial process.
R-StH

Finds a stakeholder operating a Host.
R-WH

Finds a solo WiFiLAN which may be a hotspot.
R-WpHS

Finds a mobile host or virtual host running on it, in a space, providing a WiFi LAN.
R-WpHSH

Finds a mobile host or virtual host running on it, in a space, providing a WiFi LAN.
R-WS

Finds a solo WiFiLAN.
R-WSS

Finds a Wired Subnet accessible from a Space.
R-WSSH

Finds a Wired Subnet provided by a gateway Host accessible from a Space.
R-HumPH

Finds a Human managing a process running on a host.
R-WiFiSS

Finds a WiFi network accessible from a Space, and the subnet it implements locally.
R-StDC

Finds a stakeholder operating a data centre.
R-SHuPH

Finds a Human managing a Space in which a Fixed Host is located.
R-SHRLnSAC

Finds a remote access service controlling a shell host in a space, and a location access context to the process.
R-RAS

Finds a remote access service.
R-Rr

Finds a solo Router.
R-RSS

Finds a Radio Subnet accessible from a Space, and the (abstract) hotspot or cellular network it implements locally.
R-RSSH

Finds a Radio Subnet accessible from a Space, provided by a gateway host, implementing an (abstract) hotspot or cellular network, plus a context in which the gateway provides the subnet.
R-RTuHP

Finds a Host running a Process used remotely by a Remote Terminal client.
R-RTuP

Finds a remote terminal using a process plus the process host.
R-RTurP

Finds a remote terminal remotely using a process plus the process host.
R-RTuRTuS

Finds a remote terminal using remotely another remote terminal which is using remotely a third process.
R-SH

Finds a Shell Host.
R-SHAC

Finds a Shell Host in a Space and an associated access context.
R-SHACP

Finds a Process running on a Shell Host in a Space and an associated Host access context.
R-SHGP

Finds a simple host running a general process.
R-SHLnSACP

Finds a remote access service controlling a process running on a shell host in a space, and a location access context to the remote access service.
R-SHP

Finds a Process running on a shell Host.
R-SHPAC

Finds a Process running on a Shell Host in a Space and the associated process access context.
R-RACuP

Finds a Remote Access Client using a Process.
R-HumP

Finds a Human managing a Process.
R-HuoH

Finds a Human operating a Host.
R-HumHRAS

Finds a human managing a host that has a root privileged remote access service.
R-DCWH

Finds a Data Centre with a router and wired network, in which is located another Fixed Host.
R-FcLSS

Finds a Logical Subnet to which is connected a Fixed Host (or a Virtual Host running on it) located in a Space.
R-FpLSS

Finds a Logical Subnet which is provided by a Fixed Host (or a Virtual Host running on it) located in a Space.
R-GH

Finds a General Host.
R-H

Finds a solo Host.
R-HAC

Finds a Host in a Space with the associated access context.
R-DCVHWS

Finds a Host that is physically in a DataCentre and connected to a Wired LAN.
R-HACP

Finds a process running on a host in a space and the host location access context.
R-HHu2

Finds a Host with two interactive users.
R-HIUS

Finds a Host in a Space connected to the Internet.
R-HL3S

Finds a host connected to an L3 subnet, and an associated network access context.
R-HLnSP

Finds a Login Service and a Process used by it on the same Host.
R-HLS

Finds a Host connected to a LogicalSubnet.
R-Hm2Hu

Finds a host and two humans that manage the host.
R-HCHLSS

Finds a Host location access context and the related host and space and one related subnet.
R-DCVHRS

Finds a Host that is physically in a DataCentre and connected to a WiFi LAN.
R-DCPS

Finds a Process hosted directly on a Data Centre.
R-DCpLS

Finds a DataCentre providing a LogicalSubnet, and a router located in the data centre.
R-AC

Finds a solo AuthClient.
R-AS

Finds a solo authentication/authorisation service.
R-C

Finds a Host that represents a virtual or physical cluster.
R-CaS

Finds a client accessing a service.
R-CcuS

Finds a client accessing a service and controlling access to the same service (which should never happen).
R-CH

Finds a solo Console Host.
R-CHS

Finds a Console Host located in a Space.
R-CS

Finds a client using a service.
R-CScP

Finds a client directly or indirectly accessing a service which is controlled by another process.
R-CuP

Finds a client accessing a service but not to get authorization decisions about 3rd parties.
R-CuScS

Finds a client using a service for application or authentication and also controlled by the service.
R-CuSHS

Finds a Host running both a Client and a Service used by the Client, in a Space.
R-DC

Finds a solo Data Centre.
R-DCH

Finds a Host resourced by a DataCentre.
R-DCLS

Finds a DataCentre connected to an Abstract Subnet.
R-HNP

Finds a Host connected to an Abstract Subnet controlled by a Process.
R-HP

Finds a Process and its Host.
R-HcWHS

Finds a WiFiLAN hotspot and its local implementation in a Space, and a host connected to the hotspot in that space.
R-HPHLS

Finds a logical subnet to which is connected a host that directly is or indirectly has a physical host.
R-HuiHS

Finds a Human interacting with a Host located in a space.
R-HuiHSt

Finds a Human interacting with a Host and their employer.
R-HuiP

Finds a Human using an interactive Process.
R-HuiPCHS

Finds a Human interacting with a Process running on a Console Host located in a space.
R-HuiPDaS

Finds a Human that uses a personal device and has access to a space.
R-HPAC

Finds a Process running on a Host in a Space and the associated process access context.
R-HuiPSt

Finds a Human using an interactive Process and their employer.
R-HuirP

Finds a Human interacting (possibly remotely) with a Process.
R-HuirRACP

Finds a Human interacting remotely with a Process via a Remote Access Clent which remotely uses the Process.
R-HumCH

Finds a Human managing a Fixed Console Host.
R-HumCHS

Finds a Human interactively managing a Host located in a space via its console.
R-HumH

Finds a Human managing a Host.
R-HumHSt

Finds a Human managing a Host and their employer.
R-HumHcS

Finds a human managing a host that has a remote management service (which may be a Login service).
R-HumHP

Finds a Human managing a host running a process.
R-HuiHRAC

Finds a Human interacting with a host that runs a remote access client.
R-HuiHPSP

Finds a Human interacting with a Process running on an interactive Host located in a private space.
R-HuiPH

Finds a Human interacting with a Personal Host.
R-HuiHAC

Finds a Human interacting with a host that runs an authentication client.
R-HuiHP

Finds a Human interacting with a Process running on a Host.
R-HprL3SAC

Finds a Layer 3 LogicalSubnet provided by a Host, along with an associated network access context.
R-HprLS

Finds a LogicalSubnet provided by a Host.
R-HprLSAC

Finds a LogicalSubnet provided by a Host and an associated network access context.
R-HRASuPcC

Finds a host running a remote access service that launches a process which is used by a client that it also controls, implying the client forwards credentials to the process.
R-HRASuPcS

Finds a host running a remote access service that launches a process which uses a service by which it is also controlled, implying that the process uses forwarded credentials to access the service.
R-HRASuPScS

Finds a host running a remote access service that launches a process which uses a service, where the service and the process are controlled by the same authenticator, implying that the process accesses the service using a token shared with it by a client.
R-HRASuPCcS

Finds a host running a remote access service that launches a process which is used by a client where both it and the client are controlled by the same authenticator, implying the client forwards credentials obtained from the authenticator to the process.
R-HuHE

Finds a human interacting with an email client running on a host.
R-HuHE2AC

Finds a human interacting directly with an email client running on a host in a space, plus the associated location access context.
R-Hui2H

Finds a physical Host with two interactive users.
R-HuiCH

Finds a Human interacting with a console host.
R-HuiCHLnS

Finds a human interacting with a console host and a login service running on a possibly remote host.
R-HuiDH

Finds a Human interacting with a Dumb Host.
R-HuiH

Finds a Human interacting with a Host.
R-HuE

Finds a human interacting with an email client.

R-L3SSg2+b

Finds a gateway from one IP subnet to a second IP subnet, along with the segment asset representing the route via the gateway, where this route is blocked by default.
R-NP

Finds a network path (which may or may not be physical).
R-L3SSg2AC

Finds a gateway from one IP subnet to an IP subnet, along with the segment asset representing the route via the gateway, and a context in which the gateway is connected to both subnets.
R-LoH

Detects a Host in a context where it is connected to a Layer 2 Logical Subnet, and the associated network interface.
R-LPLS2NSg2

Finds a route between subnets through a gateway where NAT is used on the return path, and a logical path traversing the forward segment.
R-LPsLS

Finds a Logical Subnet at the start of a Logical Path.
R-NoH

Finds an open network path from a remote attacker subnet to (but not via) a Host connected to a local subnet, and the associated network interface and access context.
R-NPLS

Finds a network path that starts and ends on the same logical subnet.
R-SgHtILS

Finds a Logical Segment via a Host routing to a Logical Subnet, and the Interface between the Host and Logical Subnet.
R-RNoH

Finds an open network path to a remote attacker subnet from a Host connected to a local subnet, and the associated network interface and access context.
R-RoH

Finds an open network path from a remote attacker L3 subnet to (but not via) a Host connected to a local subnet, and the associated network interface and access context.
R-RScGcRS

Finds a Physical Host connected between two WiFi subnets, both in the same space.
R-Sg

Finds a logical segment between two subnets, plus the associated gateway host and its inbound and outbound interfaces.
R-SgAC

Finds a logical segment between two subnets, plus the associated gateway host, and a host location context where the segment is active.
R-SgHfILS

Finds a Logical Segment via a Host routing from a Logical Subnet, and the Interface between the Host and Logical Subnet.
R-L3SSg2

Finds a gateway from one IP subnet to an IP subnet, along with the segment asset representing the route via the gateway.
R-RIoH

Finds an open network path to the Internet from a Host connected to a local subnet, and the associated network interface and access context.
R-L3rGrL3

Finds a Host providing two IP subnets, both in the same space.
R-WScMcWS

Finds a Mobile Host connected between two Wired LANs, both in the same space.
R-L3cGrL3

Finds a Host connected from an IP subnet to an IP subnet that it provides, both in the same space.
R-L3rGcL3

Finds a Host connected from an IP subnet to an IP subnet, the former being provided by the Host, and both in the same space.
R-DDoH

Finds an open network path from the Internet to (but not via) a Host connected to a local subnet, and the associated gateway and target network interfaces.
R-GHRS

Finds a gateway providing a radio subnet to which a host is connected.
R-GHRSi

Finds a gateway providing a radio subnet to which a host is connected, where the radio subnet implements itself (i.e. it is not the local realisation of a hotspot or cellular network).
R-GHWS

Finds a gateway providing a wired subnet to which a host is connected.
R-HIoH

Finds a Host connected to the Internet, and the associated network Interface.
R-HLoH

Finds a Host connected to a Layer 2 Logical Subnet, and the associated network Interface, and a second, remote host on the same subnet.
R-HRSGS

Finds a host connecting to a radio subnet implementing an (abstract) hotspot or cellular network, and a gateway host located in a space that is providing the network.
R-HRoH

Finds a Host connected to a Layer 3 Logical Subnet, and the associated network Interface, and a second, remote host on the same subnet.
R-HSWS

Finds a host located in a space connecting to a wired subnet.
R-HWSGS

Finds a client host connecting to a wired network, and a gateway host located in a space that is providing the network.
R-I

Finds an Interface.
R-ILSA

Finds an Interface connecting to a Logical Subnet that implements an Abstract Subnet.
R-INC

Finds a solo Interface, plus the associated host, subnet, and a host network access context where the interface is connected.
R-IoH

Finds an open network path from the Internet to (but not via) a Host connected to a local subnet, and the associated network interface and access context.
R-L3cGcL3

Finds a Host connected from an IP subnet to an IP subnet, both in the same space.
R-HSRS

Finds a host located in a space connecting to a radio subnet implementing an (abstract) hotspot or cellular network.

R-HPrDSCCV

Finds a host running a Process with read access (crudr) to a locally stored data copy, plus the data access asset representing the data deserialization, and a channel to a key vault that controls the stored data.
R-HuCAP

Finds a client attack path from a subnet, plus the associated client, service process and service host, and the service and service host managers.
R-HuCCCS

Finds a User of an interactive Client using a Service with a ClientChannel between them, plus their hosts.
R-HuDFrXSS

Finds human using a web browser that uses a service with a host and host manager, where the browser also uses inflowing data.
R-HuDFsXSS

Finds a human using a web browser that accesses a service which is using inflowing data and whose host has a manager. The destination of the flow is matched twice, so it can be referred to by either role name.
R-HuDFTCS

Finds a Human using a Web Browser that accesses a Service, where the browser consumes a data flow that is viewed by the user, plus the client channel associated with the commnication and data flow.
R-HuDSrXSS

Finds human using a web browser that uses a service with a host and host manager, where the browser also uses locally stored data.
R-HuDSsXSS

Finds a human using a web browser that accesses a service which is using stored input data and whose host has a manager.
R-HuDSTCS

Finds a Human using a Web Browser that accesses a Service, where the browser consumes a locally stored data input viewed by the user, plus the client channel associated with the data use and client-service commnication.
R-HPdDSCCV

Finds a host running a Process with write/delete access (crudd) to a locally stored data copy, plus the data access asset representing the data deserialization, and a channel to a key vault that controls the stored data.
R-HuHW2ACE

Finds a Human using a web browser running on a host to access email, when the host is located in a space, plus the associated host location access context.
R-HuiHCCCS

Finds a Human using a Host to run a Process that is a Client of a Service.
R-HuiHrCCCS

Finds a Human using a Host running a Remote Access Client used to access a Process that is a Client of a Service.
R-HuirRACSPH

Finds a Human interacting remotely with a Process via a Remote Access Clent, plus the Process Host, collocated Remote Access Service, and the Client Channel between the Remote Access Client and the Remote Access Service.
R-HuiSP

Finds a Human interactively using a reverse proxy (which is not normally permitted).
R-HumCCCS

Finds a User managing a Client using a Service with a ClientChannel between them, plus their hosts.
R-HuSAP

Finds a service attack path from a subnet, plus the associated service process and service host, and the service and service host managers.
R-SSCLS

Finds a service and its host and a service channel from a client via a logical subnet to which the host is connected, plus the associated process access contexts.
R-HLSISC

Finds a host connecting to a logical subnet by authenticating to a controlling service.
R-DSrXSS

Finds human using a web browser that uses a service with a host, where the browser also uses locally stored data.
R-DSsXSS

Finds a human using a web browser that accesses a service running on a host and using stored input data.
R-HuSC

Finds a service channel representing a privileged communication path to a service, plus the associated service process and service host, and the service and service host managers.
R-CuPnS

Finds a client accessing a process that directly or indirectly uses a service, where the process shares or forwards client credentials and sends them to the service.
R-CuPuS

Finds a client process using a service using another service.
R-CuPuSCC

Finds a client accessing a service indirectly, via one intermediary, plus the auth channels between client and service and between each and the intermediary process.
R-CuPvnS

Finds a client accessing a process that is in a credential forwarding chain with a service used indirectly by the client (i.e., the service is at the end of the chain).
R-CuPvSCC

Finds a client accessing a service indirectly, where there is more than one intermediary, plus the first intermediary adjacent to the client, and channels between client and service and between the client and this intermediary process.
R-CuvS

Finds a client indirectly accessing a process via a credential sharing/forwarding chain.
R-CvPuSCC

Finds a client accessing a service via more than one intermediary, plus the last intermediary adjacent to the service, and channels between client and service and between this intermediary process and the service.
R-CvPvSCC

Finds a client accessing a service via at least two intermediaries, and two intermediaries that are adjacent, and the channels between client and service and between these two intermediary processes. Note that the link from the client is to the intermediary proxy that is closer to the service, and vice versa. This guarantees that these two links will be usesIndirectly (indirect) and not accessesService (direct) in the matching system assets.
R-CzS

Finds a client providing authorization claims to a remote service.
R-CzSzP

Finds a client sending an authorization token to a service which uses a separate OAuth-style process to validate and exchange the token.
R-DDoS

Finds a service and client, where the communication path crosses the Internet.
R-DFDSCS

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction client to service.
R-DFDSSC

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction service to client.
R-DFrXSS

Finds human using a web browser that uses a service with a host, where the browser receives data from another process, plus the client channel between the browser and the service.
R-DFsXSS

Finds a human using a web browser that accesses a service running on a Host and using inflowing data. The data flow destination is matched twice so it can be referred to in CSGs using different role names.
R-DoS

Finds a service with its host, and a service attack path to the service from a (possibly remote) subnet.
R-CuPiS

Finds a client process using a service indirectly using another service.
R-HuStCCCS

Finds the Employer of a User of an interactive Client using a Service with a ClientChannel between them, plus their hosts.
R-SCAPvLS

Finds a Host running a Service connected via an Interface to a Subnet visited by a Service Channel via an Attack Path to the Service Process.
R-OCAPNoS

Finds a service and its host accessed by a client via the associated client channel on an open client attack path from a logical subnet where messages from the attacker can be distinguished from those from the client.
R-ScDACDACCDF

Finds a data flow to a service from an indirect client, where the client creates the data flow from an inbound data asset controlled by a vault.
R-ScDASDACCDF

Finds a data flow from a service requested by an indirect client, where the service creates the data flow by decrypting an inbound data asset controlled by a vault.
R-SCDS

Finds a client and service plus the associated client channel where there is a data step from the service to the client.
R-SCLPLSg

Finds a service channel via a logical path that traverses a logical segment.
R-SCLPvLS

Finds a service channel via a logical path that visits a subnet.
R-SCLSg

Finds a service channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host.
R-SCLSI

Finds a Service Channel via a Logical Subnet connected to the service host.
R-SCNSg

Finds a Service Channel traversing a NAT segment, and the subnets on either side.
R-SCsAPtI

Finds an Attack Path from a subnet at the start of a Service Channel, the path from which is a subpath of the Service Channel path, a gateway segment visited along that path, and the subnet and interface on the attacker side of that gateway.
R-SCvLS

Finds a Service Channel that visits a Logical Subnet, plus the Service and the Interface into the subnet.
R-SOCAP

Finds a service channel linked with an open client attack path from a logical subnet to the service process.
R-SP

Finds a reverse proxy process.
R-SPNaLnS

Finds a host running a remote access service accessed by a reverse proxy, plus the associated client channel.
R-SPNaS

Finds a host running a service accessed by a reverse proxy, plus the associated client channel.
R-SPuS

Finds a reverse proxy directly using a service.
R-SSClIAP

Finds a service channel from a last interface to a service process via an attack path.
R-CucSaP

Finds a Client using a Service with forwarded or shared credentials, and also using a third Process for authentication which controls the Service.
R-SCCHNPLS

Finds a Service Channel via a Logical Path from a Client, the Client Host, Subnet and Interface.
R-NPSCCAP

Finds an off-channel Client Attack Path via Network Path from an attacker Subnet into a Service Channel.
R-SCCAP

Finds a service channel linked with a closed client attack path from a logical subnet to the service process.
R-RTvSPRAS

Finds a remote terminal client using a reverse proxy chain that provides access to a remote access service.
R-OSAPLaS

Finds a host connected to an L2 subnet running a service, and an open service attack path from the subnet to the service.
R-OSAPNaS

Finds a host running a service and an open service attack path to the service from a logical subnet.
R-PCaFCSCCC

Finds a client channel via a service channel which is accessible to a client in a process context.
R-PCaTSSCAP

Finds an attack path path via a service channel on which a service is accessible in a process context.
R-PCaTSSCCC

Finds a client channel via a service channel which gives access to a service in a process context.
R-PcC

Finds a client that is controlled by another process.
R-PccCuS

Finds a client using a service for application or authentication, where both client and service are controlled by the same process.
R-PCCPCCS

Finds a reverse proxy accessing another reverse proxy that accesses a service, via the associated client channels.
R-PcP

Finds a Process in the role of Proxy controlling another Process.
R-PILS

Finds a Process running on a Host connected via an Interface to a Logical Subnet.
R-PnPnS

Finds a client using a service with shared or forwarded credentials, where the service uses another service in the same way.
R-RACvSPHRASP

Finds a host running a process and a remote access service that uses the process, and is used by a remote access client via a reverse proxy chain.
R-RDvSPDtS

Finds a remote desktop client using a reverse proxy chain that provides access to a remote desktop service.
R-RDvSPHP

Finds a Host running a Process used remotely via a reverse proxy by a Remote Desktop client.
R-RDvSPIP

Finds a remote desktop client using a reverse proxy chain that provides access to an interactive process.
R-RTvSPCP

Finds a remote terminal client using a reverse proxy chain that provides access to a console (command line interactive) process.
R-RTvSPHP

Finds a Host running a Process used via a reverse proxy chain by a Remote Terminal client.
R-SC

Finds a client and service connected by a service channel, plus the service host.
R-CSLSH2

Finds a client and service whose hosts are connected to the same logical subnet.
R-CCS

Finds a client and service connected by a client channel.
R-CSL3H

Finds a client channel whose client and service are collocated on a cluster host that is accessible in a space, and an L3 Subnet connecting to the cluster.
R-CCAPNoS

Finds a service and its host accessed by a client via the associated client channel on a closed client attack path from a logical subnet where messages from the attacker come from the same address as those from the client.
R-CCCCAP

Finds a Client Channel via a proxy Client Channel that goes via an Attack Path.
R-CCCfCCS+aFC

Finds a Client accessing a Service via a Proxy, with the channel between the Client and Service, the channel to the first Proxy, and the client and service hosts, plus a client context in which the client can access the proxy channel.
R-CCCLnS

Finds a Client and Remote Access Service with a ClientChannel between them, plus their hosts.
R-CCCPCCS

Finds a client accessing a reverse proxy that uses a service, via the associated client channels.
R-CCCS

Finds a Client and Service with a Client Channel between them, plus their hosts.
R-CCCSCCS

Finds a client accessing a service that uses another service, via the associated client channels.
R-CAPSAP

Finds a Client Attack Path via a Service Attack Path.
R-CCCSCCSDF

Finds a client accessing a service that uses another service, via the associated client channels, plus a data flow from the second service to the first.
R-CCCSDFCCS

Finds a client accessing a service that uses another service, via the associated client channels, plus a data flow to the second service from the first.
R-CCCSPCCSDF

Finds a client accessing a proxy that (directly or indirectly) uses a service that uses a second service, with a data flow from the second service to the first, plus the associated client channels.
R-CCCSPDFCCS

Finds a client accessing a proxy that (directly or indirectly) uses a service that uses a second service, with a data flow to the second service from the first, plus the associated client channels.
R-CCCSPSFCS

Finds a client sending a flow of data to a service via a chain of intermediaries, over which the client communications authentication or authorization credentials.
R-CCCSPSFSC

Finds a client receiving a flow of data from a service via a chain of intermediaries, over which the client communications authentication or authorization credentials.
R-CCCSvLS

Finds a Client with a Client Channel to a Service via an adjacent L2 subnet, plus their hosts.
R-CCCtCCS+aTS

Finds a Client accessing a Service via a Proxy, with the channel between the Client and Service, the channel from the last Proxy, and a service context in which the service can be accessed via the proxy channel.
R-CCCSCS

Finds a Client and Service connected via a Service Channel, plus the Client Channel between them. The presence of a Service Channel means this is a direct connection (not via a reverse proxy) involving communication over a network (not via a local API or sockets).
R-CAPNPSAP

Finds a Client Attack Path via a Service Attack Path and a Network Path.
R-CAPlISAP

Finds a client attack path via a service attack path where the former has a last interface.
R-CACSScS

Finds a channel between a client and a service, where authentication on this channel is controlled by authentication on another channel from the same client to a second service, along with the hosts of the client and the second service.
R-ACDFCS

Finds a data flow that goes via a client and thence a service, and the related auth channel and data.
R-ACDFFC

Finds a data flow from a client to/via a service, and the associated auth channel, data and data access. The source and destination of the flow are matched twice, so they can be referred to by either role name in control strategies.
R-CSLS2H2

Finds a client and service running on different hosts connected to different logical subnets that are not hotspots, and a network path between the two subnets.
R-ACDFSC

Finds a data flow that goes via a service and thence a client, and the related auth channel and data.
R-ACDFTC

Finds a data flow to a client from or via a service, and the associated auth channel, data and data access. The destination of the flow is matched twice, so they can be referred to by either role name in control strategies.
R-ACDFTS

Finds a data flow to a service from/via a client, and the associated channel, data and data access. Note that roles FlowsTo and Service are matched by the same asset(s). Having two roles makes it possible to create links to control strategies using either role name.
R-ACDFVFC

Finds a data flow encrypted with keys from a vault, flowing from a client to/via a service, and the associated auth channel, data and data access. The source and destination of the flow are matched twice, so they can be referred to by either role name in control strategies.
R-ACDFVFS

Finds a data flow encrypted with keys from a vault, flowing from a service to/via a client, and the associated channel, data and data access. Note that roles FlowsFrom and Service are matched by the same asset(s). Having two roles makes it possible to create links to control strategies using either role name.
R-ACDFVTC

Finds a data flow encrypted with keys from a vault, flowing to a client from a service, and the associated auth channel, data and data access. The destination of the flow is matched twice, so they can be referred to by either role name in control strategies.
R-ACDFVTS

Finds a data flow encrypted with keys from a vault, flowing to a service from/via a client, and the associated channel, data and data access. Note that roles FlowsTo and Service are matched by the same asset(s). Having two roles makes it possible to create links to control strategies using either role name.
R-CACHcLSS

Finds a service accessed by a client via a subnet the client is on, and an associated context for access to the client.
R-CACHLSS

Finds a service accessed by a client via a subnet the client need not normally be on, and an associated context for access to the client.
R-CACPaACS

Finds a client providing authentication credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes.
R-CACPzACS

Finds a client providing indirect authorization credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes.
R-CACS

Finds a Client and Service with an Auth Channel between them, plus their hosts.
R-CACScACP

Finds a client and process connected via a channel, where the client also uses another service that controls the process, along with the associated channels.
R-CACSSaS

Finds a channel between a client and a service used to pass authorization tokens, and a second channel from the service to another service used to validate those tokens, along with the hosts of the client and the second service.
R-CCCvCCS

Finds a Client accessing a Service via a Proxy, with the Client Channel between the Client and Service, the channel to the Proxy, plus the client and service hosts.
R-CCCvCCvLS

Finds a Client Channel from a Client process that goes via a Logical Subnet and also via another Client Channel (i.e. the client and service communicate via a credential sharing/forwarding chain).
R-ACDFFS

Finds a data flow from a service to/via a client, and the associated channel, data and data access. Note that roles FlowsFrom and Service are matched by the same asset(s). Having two roles makes it possible to create links to control strategies using either role name.
R-CCDFCS

Finds a data flow that goes via a client and thence via a service, plus the related client channel and data.
R-CDBSCDSF

Finds a process using data served by a DB service the process is using, and the associated client channel, host and data copy assets.
R-CRoS

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, and a Logical Subnet used by at least one path from the client, plus the Client Path for that Client from this Subnet.
R-CRoSG

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, an Interface from a Gateway host to a subnet on at least one path from the Client, plus the Client Path from that Interface, and an access context for the gateway where it is on the relevant path.
R-CRoSI

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, an Interface from a Gateway host to a subnet on at least one path from the Client, plus the Client Path from that Interface.
R-CSAPNaS

Finds a host running a service and a closed service attack path to the service from a logical subnet.
R-CSCCHu

Finds a Human manager of a Service and a Client Channel to the Service from a Client.
R-CSCCHuSt

Finds a Human manager of a Service and their employer, and a Client Channel to the Service from a Client.
R-CSCCSC

Finds a Client and Service with a Client Channel between them and a single associated Service Channel.
R-CSCLS

Finds a client and its host and a service channel to the service via a logical subnet to which the host is connected, plus the associated process access contexts.
R-CSCLS+ii

Finds a client and its host (and physical host) and a service channel to the service via the Internet to which the host need not be connected, accessible from the World in which the host need not be located.
R-CSCLS-ii

Finds a client and its host (and physical host) and a service channel to the service via an L3 subnet to which the host need not be connected, accessible from a space in which the host need not be located.
R-CSCvLS

Finds a Service Channel from a client process to a service, and a logical subnet visited by it, plus the interface from which the channel enters that subnet.
R-CSDS

Finds a client and service plus the associated client channel where there is a data step from the client to the service.
R-CSHSAC

Finds a service accessed by a client and an associated context for access to the service.
R-CSL0H

Finds a client channel whose client and service are collocated on a host, and an internal (socket) LAN provided by the host that is accessible in a space.
R-CSL1H2

Finds a client and service whose hosts are connected in a pair, plus their interfaces on each side.
R-CCDFCDAScDA

Finds a data flow from a service to an indirect client, where the client encrypts the data flow to create an outbound data asset controlled by a vault.
R-CDBSCDSDA

Finds a process using a DB service to update data, where the data in this case may or may not normally be accessed via the process.
R-CDBSCDADS

Finds a process using a DB service to update data, where the data in this case may or may not normally be accessed via the process.
R-CSCC

Finds a Client and Service with a ClientChannel between them, plus their hosts.
R-CCtI

Finds a Client Channel to an Interface at the Service host.
R-CCDFSC

Finds a data flow that goes via a service and thence a client, and the related client channel and data.
R-CCDFSDAScDA

Finds a data flow to a service from an indirect client, where the service encrypts the data flow to create an outbound data asset controlled by a vault.
R-CDBSC

Finds a process acting as a client to a DB in a context where the connection between them is open.
R-CCDFSFS

Finds a data flow to/via a client from a service, and the associated client channel, data and the first data step. The source of the flow is matched twice, so it can be referred to by either role name.
R-CCDFSTC

Finds a data flow to a client from/via a service, and the associated client channel, data and the last data step. The destination of the flow is matched twice, so it can be referred to by either role name.
R-CCDFSTS

Finds a data flow from/via a client to a service, and the associated client channel, data and the last data step.
R-CCDS2FC

Finds a data flowing from/via a client via a service, plus the associated client channel and the data steps from the client and from the service.
R-CCDS2TC

Finds a data flowing to/via a client via a service, plus the associated client channel and the data steps to the client and to the service.
R-CCfI

Finds a Client Channel from an Interface at the Client host.
R-CCDFSFC

Finds a data flow from a client to/via a service, and the associated client channel, data and the first data step. The source of the flow is matched twice, so it can be referred to by either role name.
R-CCSCAP

Finds a Client Channel via a Service Channel that goes via an Attack Path.
R-CCSCCP

Finds a client channel via a service channel that is via a client path.
R-CCSCvLS

Finds a Client Channel via a Service Channel that visits a Logical Subnet.
R-CCSCfI

Finds a Client Channel via a Service Channel that goes from an Interface.
R-CCSCtI

Finds a Client Channel via a Service Channel that goes to an Interface.
R-CCSCtSg

Finds a Client Channel via a Service Channel that goes via a Logical Segment.
R-CCSCvI

Finds a Client Channel via a Service Channel that goes via an Interface.
R-CCSC

Finds a client and service connected by a client channel and a service channel.

R-HDFrSACDFiaS

Finds a Process that receives a data flow from a client over one channel, and reads data in a data flow from a service over a second channel, plus an associated process location context in which the process can be accessed via the first channel but access to the service over the second may be interrupted.
R-HDFSACaiFS

Finds a Process that receives a data flow from a client over one channel, and sends the same data in a data flow to a service over a second channel, plus an associated process location context in which the process can be accessed via the first channel but access to the service over the second may be interrupted.
R-HDFSFC

Finds a process that receives data over a channel from a client, and sends the data over a channel from a client, plus the process host.
R-HDFuCuDFS

Finds a Process that reads (needs) a data flow from a service over one channel, and reads (needs) a data flow from a service over a second channel, plus the process host.
R-HDFuSC

Finds a process that reads (needs) data sent over a channel from a client, and a second channel to the process that may or may not be from a distinct client, plus the process host.
R-IDFfCCCftS

Finds a client-service channel to a service, and a location context at the service where it can be accessed via the channel, plus a data flow over the channel from client to service which flows to the service in that context and is used as input by the service.
R-SCLSgfTS

Finds a Service Channel traversing a NAT segment (with its interfaces) after which source addresses can be distinguished from a client.
R-NP2CCAPSC

Finds a service channel via a closed subnet (before a subsequent NAT gateway) with a nework path to the channel via this subnet, and an extension via a logical segment from an attacker subnet.
R-SCLSgvTS

Finds a Logical Path traversing a logical segment, and the subnets on either side, where source addresses in the subnet after the segment are not meaningfully comparable to client addresses.
R-SCNP2CPtI

Finds a service channel via a client path from a subnet in the channel to an interface on a subnet at or after the start of the attack path.
R-SCxAPtI

Finds an Attack Path starting from a subnet in a Service Channel, the path from which is a subpath of the Service Channel path, a gateway segment visited along that path, and the subnet and interface on the attacker side of that gateway.
R-SPvSPvS

Finds a reverse proxy using a second reverse proxy that uses a service, with mutual authentication at each step.
R-HDFcCrAC

Finds a Process that creates data in a context, and sends it to a service over a channel.
R-NP1CCAPSC

Finds a service channel via a closed subnet (before a subsequent NAT gateway) and a network path into the channel via this subnet traversing a single logical segment.
R-HDFcCaiAC

Finds a Process that creates data and sends it to a service over one channel, and has a location access context in which it can connect to the service by access may be interrupted.
R-HDFCFS

Finds a Process that receives a data flow from a service over one channel, and sends the same data in a data flow to a service over a second channel.
R-DFtP

Finds a DataFlow to a Process.
R-DFuCuS

Finds a data flow via two processes, one of which is indirectly a client of the other via a chain of credential sharing/forwarding intermediaries.
R-APxSCtI

Finds an Attack Path starting from a subnet off a Service Channel, the path from which extends a subpath of the Service Channel path, a gateway segment visited along that path, and the subnet and interface on the attacker side of that gateway.
R-CCCfS+aFC

Finds a client-service channel, the client and service, and an access context at the client in which the client can access the channel.
R-CCCftS+aFC

Finds a client-service channel, the client and service, and an access context on each side, where the channel can be accessed from the client.
R-CSCCAPNP4

Finds a service channel from a client to a service with a network path from an attacker subnet into the channel via a closed subnet, where the network path is consistent with an extension of the on-channel subpath.
R-CSCscLS

Finds a Service Channel from a client process to a service, and a logical subnet from which source addresses are obscured by NAT.
R-CCCfS

Finds a client-service channel, the client and service, and an access context at the client.
R-CuSPvS

Finds a client using a reverse proxy that uses a service.
R-DFDSfP

Finds a DataFlow via a DataStep from a Process.
R-DFfCCCfS

Finds a client-service channel, the client and service, and an access context at the client where it can access the channel, plus a data flow over the channel from client to service.
R-DFfCCCtS

Finds a client-service channel, the client and service, and an access context at the service where it can be accessed via the channel, plus a data flow over the channel from client to service.
R-DFtCCCtS

Finds a client-service channel, the client and service, and an access context at the service where it can be accessed via the channel, plus a data flow over the channel from service to client.
R-DFtCCCfS

Finds a client-service channel, the client and service, and an access context at the client where it can access the channel, plus a data flow over the channel from service to client.
R-CSCsdLS

Finds a Service Channel from a client process to a service, and a logical subnet from which source addresses remain unaltered by NAT.

R-SHVH

Finds a Virtual Host provisioned on a Simple Host.
R-THVH

Finds a Virtual Host provisioned on a Trivial Host.
R-VC2H

Finds a virtual channel between two physical hosts.
R-VCH2LS2PP

Finds a virtual subnet communication path between physical hosts, including the virtual channel, path generator and the start and end subnets.
R-VH

Finds a solo Virtual Host.
R-VHH2

Finds a VirtualHost provisioned at a Host for which it is also on the path to a physical host.
R-VH2H

Finds a VirtualHost above a Host provisioned at an SHost.
R-VHH3

Finds a virtual host provisioned by two hosts.
R-VSVC4H

Finds a virtual subnet and two connected hosts with distinct physical hosts between which virtual subnet messages should flow.
R-VHHsD

Finds a Virtual Host above another Host in a virtualisation stack where both store the same Data.
R-VHPH

Finds a virtual host provisioned by a physical host.
R-VHPhDHS

Finds a Virtual Host running a Process that handles Data, which is in a virtualisation stack above a second Host running a Process that Serves the Data, and where there is a Process serving the Data which may or may not be the same as either of the previous two.
R-VSHC

Finds a host channel supporting a virtual subnet, and the associated hosts.
R-VSPS

Finds a Virtual Subnet using a Physical Subnet to route at least one host-host connection.
R-VSPSH

Finds a Virtual Subnet provided by a Gateway Host using a Physical Subnet to route at least one host-host connection.
R-SC4HVSVC

Finds a Service Channel crossing a Virtual Subnet between two Hosts, and the Virtual Channel representing the physical connectivity requirement to support this communication.
R-VSVCHC

Finds a Virtual Subnet via a Virtual Channel via a Host Channel.
R-VSVCHCLS

Finds a virtual subnet that uses a physical subnet.
R-VHHH

Finds a VirtualHost provisioned at a Host and running on a PhysicalHost.
R-SC4HVSHC

Finds a Service Channel crossing a Virtual Subnet between two Hosts, and the Host Channel representing a physical network path supporting this communication.
R-HL

Finds a solo HostLAN
R-LSo

Finds a solo overlay Logical Subnet.
R-CCSCHC

Finds a Client Channel via a Service Channel that depends on connectivity represented by a Host Channel.
R-CCSCVC

Finds a Client Channel via a Service Channel that requires connectivity represented by a Virtual Channel.
R-CVHHDC

Finds a clusterable virtual Host provisioned on a physical host at a DataCentre.
R-CVHHH

Finds a cluster VirtualHost provisioned at a Host and running on a PhysicalHost.
R-DCCVH

Finds a Data Centre with a Cluster on which is provisioned a Virtual Host.
R-DCVHC

Finds a DataCentre containing a Cluster of servers, and a Virtual Host.provisioned by the Data Centre.
R-DCVHVS

Finds a Host that is physically in a DataCentre and connected to a virtual subnet.
R-LSoLS

Finds a Logical Subnet that is an overlay on another Subnet.
R-EH

Finds a solo elastically scalable host.
R-H2dPH2

Finds two hosts on a virtual subnet and their physical hosts.
R-HACVH

Finds a virtual host provisioned by a host in a space, and a location access context for the second host.
R-HCLSg

Finds a host channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host.
R-HuiVH

Finds a Human interacting with a Virtual Host.
R-HumHVH

Finds a VirtualHost provisioned at a Host managed by a Human.
R-HVH

Finds a VirtualHost provisioned at a Host.
R-HVHS

Finds a VirtualHost provisioned at a Host which is physically located in a Space.
R-HVSICSG

Finds a host connecting to a virtual subnet, plus the controlling service and connection to it from the authentication client on the host.
R-GHVS

Finds a gateway providing a virtual subnet to which a host is connected.