Abstract: A directive management system may receive a source directive from a source cloud-native application protection platform (CNAPP). The source directive defines an ephemeral condition in applying the source directive. The system may create a common intermediate representation (CIR) that includes the ephemeral condition normalized as a parameter in the CIR. The system may translate the CIR into a default machine-executable directive that is executable by a target CNAPP. The system may receive an event trigger that matches the ephemeral condition stored in the CIR. The system may create, responsive to receiving the event trigger that matches the ephemeral condition, an ephemeral machine-executable directive from the CIR. The ephemeral machine-executable directive is used to supersede the default machine-executable directive at least temporarily. The system may transmit the ephemeral machine-executable directive to the target CNAPP.