system behavior

The aggregate observable and operational conduct of a computing system — encompassing how it executes processes, enforces access decisions, handles data, and responds to inputs under both normal and adversarial conditions. It is distinguished from individual component states or user actions by treating the system as a whole actor whose runtime conduct (commands executed, privileges exercised, data flows produced) can be authorized, constrained, monitored, or subverted. Security engineering uses it as the object of protection: the goal is to sustain intended and authorized system behavior despite adversity. In practice, controls such as least privilege, configuration management, and access enforcement are applied precisely to bound what the system is permitted to do — ensuring that processes operate at privilege levels no higher than necessary and access systems only as required to accomplish organizational missions. Restricting commands that could *modify* system behavior is therefore a canonical control objective, because unauthorized change to that conduct is itself the threat.

Advisory only. A term this product ships is defined by an authority document, not by a search result.