Objective
Hunt, contain, evict.
Joint meaning. Dominate.
Discussion
The adversary is on or adjacent to key terrain. The objective is to hunt, contain and evict, and the measure of the phase is time: mean time to evict against the adversary’s dwell budget.
Dominate is the only phase in which deliberately giving ground is the correct default. Isolation and retrograde — severing a segment, revoking a credential set, degrading a service to read-only — preserve the force and the data at the cost of function. A program that has never rehearsed retrograde will improvise it under contact, and improvised retrograde is how statutory availability is lost.
It is also the phase in which the statutory availability floor does its real work. The floor is a pre-agreed statement of what may be degraded, made when nobody was under pressure. Its entire value is that it exists before the moment someone has to decide whether to take a public service offline.
What the Main Effort Typically Is
Every other phase designates a piece of terrain. In Dominate the adversary is already on the terrain, so concentration of effort means concentration against the clock: closing the defender loop faster than the adversary can consolidate. The temporal advantage ratio stops being a report and becomes the operational objective.
Typical, not prescribed. The main effort is designated per campaign against the decisive points the terrain analysis produced; what this phase does is narrow the field of sensible answers.
Dominant Forms of Maneuver
- M7 CounterattackSeize the initiative and evict before the adversary reaches the objective. Indicator: Mean time to evict is inside the adversary’s dwell budget.
- M8 Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open. Indicator: Containment is achieved without losing statutory availability.
- M5 AmbushTrade space for information and time, and impose cost. Indicator: The adversary interacts with a decoy, producing a detection with no false-positive budget.
Entry and Exit Conditions
A phase is declared on an observable condition and ended on one. Declaring on a feeling produces a phase nobody can argue with and nobody can end.
Declare This Phase When
- Adversary presence confirmed on or adjacent to a designated decisive point.
- Canalization has failed — observed lateral movement is landing outside instrumented terrain.
- A barrier the reachability result depended on is confirmed breached.
Leave This Phase When
- Eviction is verified by hunt rather than inferred from the absence of alerts. No adversary-controlled access remains, and that is a positive finding by someone who went looking.
- The estate is not yet trustworthy, but the adversary is out — declare Stabilize. The two are different states and collapsing them is how a reinfection gets called a new incident.
What Changes in Cadence and Authority
These are the two operational consequences of the declaration. A phase change that moves neither has changed a word on a slide.
- Cadence
- Continuous. The six steps compress into the response’s battle rhythm — a framing at each shift handover, mapping continuously as the picture changes, arraying against each new branch. The cycle does not stop; it stops being scheduled.
- Authority
- Broadest of any phase. Destructive and degrading actions come into the pre-authorized set, bounded by the statutory availability floor and nothing else. This is also the phase that produces the most authority exceptions, and they should be logged rather than avoided — an exception is evidence about the rules of engagement, and Phase V is where that evidence gets used.
How It Differs from the Phases Beside It
Against Seize Initiative
The adversary is conceded to be on key terrain. The forms shift from canalize-and-delay to hunt-and-evict, and the availability risk the defense is willing to accept rises sharply.
Against Stabilize
Dominate ends when the adversary is out. Stabilize begins from the assumption that the estate is still untrustworthy — everything in it is a claim to be proved, not an adversary to be fought.
The Controls Most Active in This Phase
- TA-1 Decision Loop MeasurementThe defender loop is the phase’s operational objective, not a reporting artifact.
- TA-2 Adversary Dwell EstimationThe dwell estimate becomes the budget the eviction is racing.
- TA-3 Temporal Advantage ThresholdTemporal advantage is computed live and drives whether to widen authority further.
- FO-5 Statutory Availability FloorThe availability floor bounds what may be degraded, and it is the reason the decision can be made in minutes.
- SM-5 Branches and SequelsBranches execute; sequels are planned for the moment eviction succeeds.
- CE-3 Fusion and ConfidenceFusion runs continuously, and confidence levels drive whether to act or to collect further.
- WF-5 Separation and Revocation TempoRevocation at tempo — the fire executed against the privileged human register.
The Failure Mode Particular to This Phase
Declaring eviction on the absence of alerts.
- The tell
- No hunt was tasked to verify eviction; the phase ended when the alerting went quiet.
- The correction
- Eviction is a positive finding produced by someone who went looking and recorded what they searched. Quiet alerting is consistent with eviction and equally consistent with an adversary who has stopped doing the noisy part.
Caveats That Hold Across Every Phase
- A phase is declared against a scope, not against an agency. An estate can be in Dominate on one mission service and Shape on everything else. The phase declaration control is written to carry a scope for exactly this reason, and a declaration without one is a statement nobody can act on.
- Phases are not maturity. Being in Phase III is not progress. It means an adversary is on or adjacent to key terrain. A program that reads the phase list as a ladder will start reporting phase advancement as achievement, which inverts the meaning of the entire model.
- Regression must be declarable without embarrassment. Campaigns go backwards. An eviction that turns out to be incomplete returns the campaign to Dominate from Stabilize. If declaring that costs someone their credibility, it will not be declared, and the campaign will be fought in the wrong phase.