Cross-trust coercion and relay

Cross-domain authentication coercion attempts to induce a partner-domain domain controller machine account to authenticate to a listener. This record currently combines distinct paths: relaying authentication to services in the partner domain, including LDAP or AD CS, and a separate own-domain unconstrained-delegation path. Which domain can accept an authentication depends on trust direction, selective-authentication policy, and target-service controls. An authentication event alone does not prove directory changes, certificate issuance, or resource access.