RFC-PAM-0002                                                   Section 13
Category: Standards Track                                       Evolution

Item	Trigger	Direction
Level-2 session recording	60 days after cutover, on usage data	`pam_tty_audit` or a forced recording shell for Operator/Admin sessions, shipped to write-once storage; if insufficient, reconsider a broker
CI-driven deploys	When the CI runner identity exists (RFC-WORKLOAD-IDENTITY-0001)	Routine `pn-deploy` runs move from humans to a machine identity; humans keep the action for rollback and incidents
Azure Machine Configuration as audit	After Phase 5	Read-only compliance view of `sudoers`/group state alongside Ansible enforcement
Root-owned, Git-controlled compose definitions	If an Editor who is not Admin-eligible is ever needed	Satisfies the alternative branch of Invariant 6
Database access tiers	When personal DB access grows beyond the current pattern	Extend the class/tier model to database roles (RFC-PAM-0001 §7 goals)
Windows hosts	Separate RFC	Entra-joined RDP with PIM; not covered here

13.2 Extension Points

New machine class: one tag value + one row in the Terraform map + (if it has a deploy tree) one project allow-list entry.
New tier: one Entra group, one Linux group, one sudoers.d policy file, one map entry — all by PR.
New person: Entra group membership only.

13.3 Deprecation Paths

POL-Developer and POL-DataServers as host-access groups are retired in Phase 3.
The shared mfaizan account is removed at cutover; its symlinks are replaced by the dc alias.
RFC-PAM-0001 moves to Superseded on acceptance of this RFC, by reviewer decision.

Previous	Index	Next
← 12. Rationale	Table of Contents	Appendix A →

End of Section 13