RFC-PAM-0002DraftPlatformArchitectureStandards Trackv1.0.0

Owner:

Created: 2026-09-17

Updated: 2026-09-17

Reviewers@snoorullah

RequiresRFC-IAM-0001, STD-IDENT-001 (ovh-infra)

Authors

Mohammed FaizanAuthor

RFC-PAM-0002                                                      Index
Category: Standards Track      Arc-Native Privileged Access & Host Authorization

RFC-PAM-0002: Arc-Native Privileged Access and Host Authorization

Index | Next: 1. Introduction →

RFC Metadata

Field	Value
RFC ID	RFC-PAM-0002
Title	Arc-Native Privileged Access and Host Authorization
Kind	Architecture
Status	Draft
Category	Standards Track
Author	Mohammed Faizan (Platform / Security)
Reviewers	Shaik Noorullah (Platform Lead)
Created	2026-09-17
Last Updated	2026-09-17
Version	1.0.0
Requires	RFC-IAM-0001 v1.0.0 (authorization ceiling); STD-IDENT-001 v1.0.0 (ovh-infra identity standard)
Supersedes	RFC-PAM-0001 v1.0.0 — access-broker selection only (Teleport). The policy goals of RFC-PAM-0001 (zero standing credentials, just-in-time elevation, least privilege, auditability, IdP-driven revocation) are retained and re-implemented on Azure Arc. Marking RFC-PAM-0001 Superseded is a reviewer decision on acceptance of this RFC.

This RFC defines how humans reach a shell on ProficientNow servers, what each person may do once there, and how that access ends — using Azure Arc SSH with Microsoft Entra ID as the only login path, Entra groups as the only source of authorization, and on-host enforcement (Linux groups, an allow-listed sudo policy, a wrapped deploy action) to express privilege levels that Azure RBAC alone cannot.

Two problems are addressed. Identity: today engineers share one local account (mfaizan) and one SSH key — no attribution, no per-person revocation, no MFA. Arc SSH already solves this on 13 of 16 Linux hosts; this RFC completes it. Authorization: the only Azure role in use grants every member of one Entra group full sudo on every host. This RFC introduces five tiers — Admin (just-in-time via Privileged Identity Management), Operator, Editor, Deployer, Viewer — so that, for example, one engineer may deploy and edit files on production while another may deploy only, with no ability to write, read secrets, or reach Docker.

A third concern, decommissioning, is made automatic: removing a person from an Entra group is the only action required; login is denied immediately, on-host privilege and sessions are removed within five minutes, and the account is archived after 30 days. The design is delivered entirely with tooling the estate already runs — Azure Arc, Entra ID, PIM, Terraform, Ansible and Microsoft Sentinel — and adds exactly two new on-host components: a group-sync agent and a deploy wrapper.

Scope Boundaries

In Scope	Out of Scope
Interactive human SSH access to Linux hosts (OVH, Contabo, on-prem, Azure witness)	Windows servers (DC02, DC03, DCNOW, DS01) — RDP/AD governed separately
Authorization tiers on the host (sudo, file write, deploy)	Web-UI SSO for platform apps (RFC-IAM-0001)
Just-in-time administrative elevation	Service-to-service / machine identity (RFC-WORKLOAD-IDENTITY-0001)
Human deploy action on compose-based hosts	Kubernetes deploys (GitOps via ArgoCD; no human deploy)
Leaver / role-change / host-retirement decommissioning	Secret storage and rotation mechanics (RFC-SECOPS-0001)
Login, privilege and deploy audit evidence in Sentinel	Network segmentation and firewalling (RFC-TENANT-SECURITY)
Break-glass access model (declared, logged)	Automation credentials used by Ansible/Terraform (preserved, not redesigned)

Primary Questions

"Which human is on this host, what may they do, and how does that end?"

Relationship to Other RFCs

RFC / Standard	Relationship
RFC-PAM-0001 (Teleport-based PAM, Draft)	Superseded in its choice of access broker; its policy goals are carried forward. Teleport was trialled and shelved (the `TeleportSentinel` connector was dormant and decommissioned 2026-09-11).
RFC-IAM-0001	Normative for the authorization ceiling: Entra group membership is the maximum any downstream system may grant. This RFC applies that ceiling to host access.
STD-IDENT-001 (ovh-infra)	Normative identity policy: group→role only, no hand-run role assignments, declared per-layer break-glass ≤4h and logged, 30-day stale-account review. This RFC is its host-shell implementation and closes its declared gap ("no stale-user pruning at the host layer").
RFC-WORKLOAD-IDENTITY-0001	Parallel; non-human identities are explicitly preserved and inventoried here but not redesigned.
STD-RBAC-001 (referenced by STD-IDENT-001, not yet written)	Section 6 of this RFC supplies the host-access group taxonomy that document was to own.

Core Sections

Introduction — background, verified current state, motivation, scope
Requirements — design goals, non-goals, invariants, success criteria
Architecture — system overview, authority domains, trust boundaries, data flows
Components — building blocks, responsibilities, interfaces, failure modes

Domain Sections

Identity and Login — the single login path, Azure roles, key/password removal, break-glass
Authorization Model — machine classes, the five tiers, the access matrix, boundaries
Deploy Action — pn-deploy, verbs per tier, validation, developer experience
Group Synchronisation — the pn-access agent, managed-identity Graph read, fail-safe rules
Decommissioning — leaver, role change, host retirement; timing guarantees
Audit and Evidence — what is recorded, what is not, alerts, retention
Rollout — phased, additive rollout; cutover; rollback