RFC-PAM-0002                                                    Section 4
Category: Standards Track                                      Components

Component	Plane	Exists today?	Owner
Entra groups `pn-host-*`	Azure	No — created by Terraform	Platform Lead
PIM policy on `pn-host-admin`	Azure	No	Security owner
Arc RBAC map (class → group → role)	Azure	Partial (`arc-config`, `dataservers-rbac.tf`) — extended	Platform Lead
`AADSSHLoginForLinux` + Arc SSH endpoint	Host	Yes on 13 hosts; 3 pending	Platform Lead
Arc managed identity + Graph permission	Azure	Identity exists on every Arc host; permission new	Platform Lead
`pn-access` synchronisation agent	Host	New	Platform Lead
Host access policy (sudo allow-list, `pam_wheel`, sshd)	Host	New Ansible role	Platform Lead
`pn-deploy` action + `dc` alias	Host	New	Platform Lead
Break-glass key per host in Key Vault	Azure	Yes (model exists); alerting new	Security owner
Sentinel DCRs, tables, analytics rules, workbooks	Evidence	Partial; extended	Security owner

4.2 Entra Groups and PIM

Aspect	Description
Responsibility	Hold the answer to "who is in which tier on which class"
Inputs	Membership edits by the Platform Lead / Security owner; PIM activation requests
Outputs	Group membership (read by Arc RBAC and by `pn-access`); PIM activation events
Dependencies	Entra ID P2 for PIM (present via M365 E5; 5 of the 7 developers hold it, 2 seats spare)
Failure Mode	Entra outage blocks all new logins (identity is the accepted external SPOF per STD-IDENT-001)
Recovery	Break-glass root key from Key Vault (Section 5.5)

Group naming follows pn-<scope>-<role> (STD-IDENT-001, sso-and-group-rbac.md); definitions in Section 6.

4.3 Arc RBAC Map (Terraform)

Aspect	Description
Responsibility	Declare, per machine class, which Entra group holds User Login and which holds the eligible Administrator Login
Inputs	Machine inventory with `pn_class` tags; the access matrix (Section 6)
Outputs	Azure role assignments scoped to each Arc machine resource
Dependencies	`terraform/modules/arc-config` and `dataservers-rbac.tf` patterns in ovh-infra; all 16 Linux hosts present in `arc_machines`
Failure Mode	A host missing from the map has no human login (fail-closed); a rebuilt host loses machine-scoped assignments (cascade delete) until the next apply
Recovery	`terraform apply` recreates assignments; CI plan on PR catches drift

Aspect	Description
Responsibility	Authenticate the Arc certificate, evaluate the two Azure roles at connection time, provision the local account, place active admins in `aad_admins`
Inputs	Arc tunnel connections from `az ssh arc`
Outputs	Local human accounts named by UPN; sshd auth events
Dependencies	Arc agent (`himds`, `gcarcservice`); HybridConnectivity default endpoint with SSH service configuration (port 22 over the relay)
Failure Mode	Arc agent down → no Arc logins to that host
Recovery	Break-glass root key; restart Arc agent (per `docs/ssh-access.md`)

Aspect	Description
Responsibility	Give each host a way to read Entra group membership without any stored secret
Inputs	Token requests from `pn-access` via the Arc local identity endpoint
Outputs	Short-lived Graph tokens
Dependencies	System-assigned identity (present on every Arc machine; e.g. uat `8d477e00-…`); an application permission limited to reading group membership, granted per identity by Terraform
Failure Mode	Permission missing → agent gets no data → makes no changes (Invariant 10)
Recovery	Terraform apply

Aspect	Description
Responsibility	Make the host agree with Entra: tier group membership, account locking/expiry/archival, session termination, drift heartbeat
Inputs	Graph group membership for the host's class; the root-owned Entra→Linux group map; the retention window
Outputs	`/etc/group` membership changes; account state changes; heartbeat records to Sentinel
Dependencies	Managed identity (4.5); Ansible-delivered map; systemd timer
Failure Mode	Agent stopped → host may lag Entra (login still denied by Azure); heartbeat absent
Recovery	Sentinel alert on missing heartbeat; Ansible re-converges

Detailed behaviour: Section 8.

Aspect	Description
Responsibility	Define what each Linux tier group may do: the Operator allow-list, the deploy rule, `su` lock, sshd settings for human accounts
Inputs	Tier definitions (Section 6)
Outputs	`sudoers.d` policy files (root-owned), PAM configuration, sshd drop-in, tier groups' existence
Dependencies	ovh-infra `host-baseline` sshd floor (already: no passwords, root prohibit-password)
Failure Mode	Policy file syntax error blocks sudo for the tier (sudoers validation prevents install of a broken file)
Recovery	Ansible re-run; break-glass

Aspect	Description
Responsibility	Let Editors and Deployers operate compose projects without Docker access
Inputs	Project, verb, optional services/ref from a human via `sudo`; root-owned project allow-list
Outputs	Compose operations executed as the `deploy` service user; invocation log; `#infra` note
Dependencies	`deploy` service account as sole `docker` group member; `/srv/pnats` layout; per-project lock
Failure Mode	Wrapper or Docker unavailable → deploy fails closed; no fallback for non-admins
Recovery	Editor activates PIM Admin for raw Docker; wrapper fixed by PR

Detailed behaviour: Section 7.

Aspect	Description
Responsibility	Hold exactly one root key per host for use when Entra or Arc is unavailable
Inputs	Key generation/rotation by the Security owner
Outputs	Emergency root SSH login (on PVE nodes via node-local `authorized_keys2`, because `authorized_keys` lives in pmxcfs and vanishes when the cluster is down)
Dependencies	Azure Key Vault (`pn-onprem-boot-kv` pattern)
Failure Mode	Key used silently — prevented by the alert in Section 10; key leaked — rotated per Invariant 11
Recovery	Rotation SOP; retrospective incident

Aspect	Description
Responsibility	Receive, retain and alert on all evidence streams (Section 10)
Inputs	AMA/DCR streams: sshd auth, `sudo` I/O, auditd, `pn-deploy` log, `pn-access` heartbeat; Entra sign-in and PIM logs
Outputs	Analytics-rule alerts; access-review and leaver workbooks; 1-year immutable archive
Dependencies	Existing Sentinel workspace and DCR/DCE pattern
Failure Mode	Stream gap — detected by heartbeat/ingestion monitoring
Recovery	AMA/DCR re-apply

Previous	Index	Next
← 3. Architecture	Table of Contents	5. Identity and Login →

End of Section 4