{
 "slug": "magnitude-bounded-connectivity",
 "topic_id": "TOPIC-155",
 "cluster": "Telecom Carrier & Subscriber Identity",
 "tier": "Tier B",
 "title": "IoT SIM fleets: who authorized a profile change on 200,000 devices?",
 "summary": "Remote SIM provisioning made connectivity a software property of very large device fleets. One console action can suspend or re-provision an entire estate, authorised by an administrator session.",
 "lede": "A connectivity management console has a bulk operations tab. It exists because operators need it. It also means a single authenticated session can take two hundred thousand meters, ambulances or telematics units off the network in one call.",
 "date": "2024-02-02",
 "category": "Vertical",
 "author_id": "nadia-ferreira-strand",
 "tags": [
  "IoT",
  "eSIM",
  "remote SIM provisioning",
  "M2M",
  "connectivity management",
  "fleet operations"
 ],
 "image_title": "Magnitude Bounded Connectivity",
 "schema": "Article",
 "key_takeaways": [
  "Connectivity platforms model authority by role. Role-based authority has no magnitude dimension, so the blast radius of a compromised administrator session is the entire fleet.",
  "Set the ceiling from outage cost, not from intuition: compute cost per device-hour of lost connectivity and work backwards.",
  "Bulk operations should require a human signature above the ceiling, and the signature should cover the device count."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Prerequisites"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "One action, an entire estate",
   "caption": "Nothing about the request is unusual except its magnitude, and magnitude is not what the control looks at.",
   "nodes": [
    {
     "label": "Console session or API key",
     "note": "platform credential"
    },
    {
     "label": "Bulk profile operation",
     "note": "a selector, not a device",
     "bad": true
    },
    {
     "label": "200,000 devices affected",
     "note": "one call",
     "bad": true
    },
    {
     "label": "Record: one API log line",
     "note": "names an account",
     "bad": true
    }
   ]
  },
  {
   "type": "ul",
   "items": [
    "An inventory of platform credentials with write access to provisioning APIs, including automation and CI tokens.",
    "Device counts reachable by each credential, by customer and by profile group.",
    "Your contractual service level commitments and the penalty structure attached to them."
   ]
  },
  {
   "type": "h2",
   "text": "Step 1 — Compute devices per credential"
  },
  {
   "type": "p",
   "html": "The organising number. For each credential, count the devices it can address with a state-changing operation — suspend, activate, change profile, change APN, push a subscription."
  },
  {
   "type": "p",
   "html": "Expect at least one credential to reach everything. Platform support accounts and automation tokens usually do, because scoping them was never a requirement."
  },
  {
   "type": "h2",
   "text": "Step 2 — Price an hour of lost connectivity"
  },
  {
   "type": "p",
   "html": "This turns a security discussion into a commercial one, which is the only way it gets funded."
  },
  {
   "type": "table",
   "caption": "Cost inputs. Use your own contracts; the categories are what matter.",
   "head": [
    "Cost component",
    "How to compute"
   ],
   "rows": [
    [
     "SLA penalty",
     "Contractual rate × affected devices × hours"
    ],
    [
     "Field remediation",
     "Devices requiring a truck roll × cost per visit"
    ],
    [
     "Customer credits",
     "Historical credit rate for connectivity incidents"
    ],
    [
     "Contract risk",
     "Probability-weighted value of contracts at renewal risk"
    ]
   ]
  },
  {
   "type": "p",
   "html": "For safety-relevant fleets — medical devices, alarm panels, utility telemetry — add the consequence that has no price and note it separately rather than pretending it can be modelled."
  },
  {
   "type": "h2",
   "text": "Step 3 — Set the ceiling"
  },
  {
   "type": "p",
   "html": "Pick the device count at which an erroneous or malicious bulk operation produces a loss your operations leadership would want to have been asked about. For most platforms that is a few thousand devices, which is far below what any credential can currently reach."
  },
  {
   "type": "p",
   "html": "Then check the ceiling against your legitimate operational history. Pull twelve months of bulk operations and look at the distribution of device counts. If ninety-five percent of legitimate operations are under five hundred devices, a ceiling of two thousand is generous and will almost never fire."
  },
  {
   "type": "h2",
   "text": "Step 4 — Express it in the credential"
  },
  {
   "type": "code",
   "text": "delegation:\n  issuer:   [platform operations lead, hardware credential]\n  delegate: [provisioning service key]\n  scope:    operations = [suspend, activate, profile_change]\n            customer = [id] | any\n  limits:   max_devices_per_operation = 2000\n            max_devices_per_hour = 5000\n  notAfter: [24 hours]\n  depth:    0"
  },
  {
   "type": "p",
   "html": "An operation exceeding the ceiling produces no valid authorisation and fails visibly. It does not partially execute — partial execution across a fleet is worse than refusal, because it leaves an inconsistent state nobody planned for."
  },
  {
   "type": "h2",
   "text": "Step 5 — Design the above-ceiling path"
  },
  {
   "type": "p",
   "html": "Large legitimate operations happen: a customer migration, a profile update across a product line, an emergency response to a network event."
  },
  {
   "type": "p",
   "html": "Above the ceiling, require a human signature over a statement that renders the device count explicitly. The person authorising a fleet-wide operation should see the number, in the statement they sign, not in a dialog they dismissed."
  },
  {
   "type": "h2",
   "text": "Step 6 — Test the failure modes"
  },
  {
   "type": "ol",
   "items": [
    "Ceiling exceeded during a scheduled automation window — does the automation fail safe and alert, or silently skip?",
    "Delegation expiry during a long-running migration — does the operation resume after renewal or restart?",
    "Issuer key rotation mid-window — both keys valid, no interruption. Test deliberately.",
    "Emergency override at 3am — is there a path, and is it recorded?"
   ]
  },
  {
   "type": "h2",
   "text": "What this does not address"
  },
  {
   "type": "p",
   "html": "There is no public incident record of malicious fleet-wide re-provisioning, and this article does not imply one. The exposure is structural: authority without a magnitude bound, on estates whose size has grown by orders of magnitude since the authority model was designed."
  },
  {
   "type": "p",
   "html": "It also does not address device-side security, radio access, or the physical SIM supply chain."
  },
  {
   "type": "h2",
   "text": "Gating by magnitude rather than by operation"
  },
  {
   "type": "table",
   "caption": "A magnitude ladder for fleet operations",
   "head": [
    "Scope",
    "Gate"
   ],
   "rows": [
    [
     "1 device",
     "API credential"
    ],
    [
     "Up to 100",
     "API credential plus rate limit"
    ],
    [
     "100 – 10,000",
     "Bound assertion from a named operator"
    ],
    [
     "<strong style=\"font-weight:600\">Above 10,000, or a whole tenant</strong>",
     "<strong style=\"font-weight:600\">Two named signatures and a delay</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "This inverts the usual instinct, which is to gate by operation type. Suspending one device and suspending the fleet are the same operation; only the selector differs, and the selector is what should set the bar."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Our platform has role-based limits.”</strong> Which bound who may perform an operation, not how many devices one performance touches. Those are different axes and most platforms only model the first."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Bulk operations are routine for us.”</strong> Then the thresholds should reflect your routine. The point is that a threshold exists and is derived from your own distribution, not that it is low."
  }
 ],
 "faq": [
  {
   "q": "Will ceilings break large customer migrations?",
   "a": "They will require a signature, which is the intent. Set the ceiling from your own operational distribution so that routine work is unaffected."
  },
  {
   "q": "Does this add latency to provisioning?",
   "a": "Verification is local and sub-millisecond. Routine operations run under a pre-signed delegation with no human in the path."
  },
  {
   "q": "What about automation and CI tokens?",
   "a": "Those are the credentials most likely to reach everything and least likely to have been scoped. Treat them first."
  },
  {
   "q": "Is any of this required by GSMA specifications?",
   "a": "No. Remote SIM provisioning specifications address the provisioning mechanism, not the authorisation model above it."
  },
  {
   "q": "Why gate by magnitude rather than operation?",
   "a": "Because suspending one device and suspending the fleet are the same operation. Only the selector differs, and that is what sets the consequence."
  },
  {
   "q": "What should the approval render?",
   "a": "The resolved count and the selector — ‘200,000 devices matching this query’ — not the operation name."
  },
  {
   "q": "How should thresholds be set?",
   "a": "From your own distribution of operation sizes, not from intuition. The 99th percentile of normal is a defensible start."
  }
 ],
 "sources": [
  {
   "t": "GSMA — eSIM remote SIM provisioning specifications",
   "u": "https://www.gsma.com/esim/esim-specification/"
  },
  {
   "t": "FTC — business guidance on marketplaces and consumer protection",
   "u": "https://www.ftc.gov/business-guidance"
  },
  {
   "t": "CISA — known exploited vulnerabilities and incident reporting",
   "u": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
  },
  {
   "t": "GSMA — fraud and security resources",
   "u": "https://www.gsma.com/solutions-and-impact/technologies/security/"
  }
 ],
 "related": [
  {
   "slug": "fleet-command-authorization",
   "title": "Who told 40,000 inverters to curtail?",
   "category": "Vertical"
  },
  {
   "slug": "line-change-authorization",
   "title": "The subscriber never signs",
   "category": "Vertical"
  },
  {
   "slug": "delegation-depth-policy",
   "title": "Agent-to-agent delegation depth",
   "category": "Developer"
  },
  {
   "slug": "wholesale-instruction-receipts",
   "title": "Telecom interconnect and settlement identity",
   "category": "Vertical"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Magnitude%20Bounded%20Connectivity/1200_630/blog.jpg",
 "wordcount": 903,
 "url": "/blog/magnitude-bounded-connectivity.html",
 "reading_time": "4 min read",
 "seo_title": "IoT SIM fleets and bulk profile changes",
 "meta_description": "Remote SIM provisioning made connectivity a software property of huge fleets. One console action can suspend or re-provision an entire estate.",
 "hub": {
  "slug": "topics/telecom-identity",
  "title": "Telecom and subscriber identity"
 },
 "answer": "One console session. Remote SIM provisioning made connectivity a software property of very large fleets, so a single action can suspend or re-provision an entire estate. The authorisation record is an API call, and the blast radius is a field in it.",
 "answer_q": "Who authorised a profile change on 200,000 devices?",
 "glossary": [
  {
   "term": "Remote SIM provisioning",
   "def": "Downloading and managing subscriber profiles over the air, which makes connectivity a software-controlled property."
  },
  {
   "term": "Blast radius",
   "def": "The number of entities affected by a single operation — the axis most authorisation models do not represent."
  },
  {
   "term": "Selector",
   "def": "The query determining which devices an operation applies to. The dangerous part of a bulk request."
  }
 ],
 "checklist": {
  "title": "Adding magnitude gating",
  "id": "magnitude",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Measure your own distribution.",
    "text": "How many devices does a typical operation touch?"
   },
   {
    "name": "Set thresholds from that, not from intuition.",
    "text": "The 99th percentile of normal is a defensible starting line."
   },
   {
    "name": "Render the count and the selector.",
    "text": "‘200,000 devices matching tenant=X’, not ‘bulk suspend’."
   },
   {
    "name": "Require two signatures above the top threshold.",
    "text": "With a short delay, which is the only thing that makes recovery possible."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav puts the subscriber or the authorising party back in the loop for the changes that matter, with a signature bound to the specific change and verifiable by a bank, a regulator or a counterparty without calling the carrier.",
  "href": "../docs.html",
  "label": "See change authorisation"
 }
}