Blast Radius

A service-desk account got phished this morning. It has no admin rights of its own. Walk the path it can actually take through your identity graph — then cut exactly three edges and find out how much of that reach was ever really about the account.