<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-privilege-access-architecture
description: >-
  Design and implement privileged access management architectures with tiered admin
  models, just-in-time access, credential vaulting, and session monitoring to reduce
  credential-based attack surface.
domain: cybersecurity
subdomain: security-architecture
tags:
  - pam
  - privileged-access
  - just-in-time
  - credential-vault
  - tiered-admin
  - rbac
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.002"]
---

# Implementing Privilege Access Architecture

## Overview

Privileged access architecture limits standing privileges, enforces just-in-time (JIT)
elevation, and monitors all administrative sessions. This skill covers tiered admin
models, credential vaulting, break-glass procedures, and PAM integration patterns.

Mode: `[MODE: ARCHITECT]` — Privileged access design and enforcement.

## Prerequisites

- Identity provider with group/role management (Azure AD, Okta)
- PAM platform or credential vault (HashiCorp Vault, CyberArk)
- Python 3.10+
- RBAC/ABAC policy engine

## Key Concepts

### Tiered Administration Model

| Tier | Scope | Examples | Controls |
|------|-------|----------|----------|
| **Tier 0** | Identity infrastructure | Domain controllers, PKI, AAD Connect | Isolated PAWs, hardware MFA |
| **Tier 1** | Server & application admin | App servers, databases, middleware | JIT access, session recording |
| **Tier 2** | Workstation & user support | Help desk, endpoint management | Scoped admin, time-limited |

### JIT Access Workflow

```
┌──────────┐    ┌──────────────┐    ┌─────────────┐    ┌──────────┐
│ Operator  │───▶│ Access       │───▶│ Approval    │───▶│ Elevated │
│ requests  │    │ Request      │    │ Workflow    │    │ Session  │
│ elevation │    │ (scope+time) │    │ (auto/human)│    │ (timed)  │
└──────────┘    └──────────────┘    └─────────────┘    └─────┬────┘
                                                             │
                                                      ┌──────▼─────┐
                                                      │ Auto-revoke│
                                                      │ + Audit log│
                                                      └────────────┘
```

### Credential Vault Integration

```python
import hvac

def get_dynamic_credentials(vault_addr: str, role: str, token: str) -> dict:
    """Retrieve time-limited database credentials from Vault."""
    client = hvac.Client(url=vault_addr, token=token)
    response = client.secrets.database.generate_credentials(name=role)
    return {
        "username": response["data"]["username"],
        "password": response["data"]["password"],
        "ttl": response["lease_duration"],
        "lease_id": response["lease_id"],
    }
```

### PAM Policy Schema

```json
{
  "policies": [
    {
      "name": "tier1-server-admin",
      "tier": 1,
      "max_duration_hours": 4,
      "require_approval": true,
      "approvers": ["security-team"],
      "mfa_required": true,
      "session_recording": true,
      "allowed_actions": ["ssh", "rdp", "kubectl"],
      "denied_actions": ["domain-admin", "schema-admin"],
      "auto_revoke": true
    }
  ]
}
```

## Workflow

### Step 1: Audit Current Privileges

```bash
node scripts/agent.js --action audit --directory users.json
```

### Step 2: Design Tier Model

```bash
node scripts/agent.js --action design --audit audit-results.json --output tiers.json
```

### Step 3: Generate PAM Policies

```bash
node scripts/agent.js --action policies --tiers tiers.json --output pam-policies.json
```

### Step 4: Validate Compliance

```bash
node scripts/agent.js --action validate --policies pam-policies.json
```

## Detection

```yaml
title: Privilege Access Architecture Detection
id: 5dee7bb2-d312-4753-be62-fadda821c6dc
status: experimental
description: Detects suspicious activity related to implementing privilege access architecture techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1078.002
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```

## Verification

- [ ] No standing Tier 0 admin credentials outside break-glass accounts
- [ ] JIT elevation requires MFA and time-bound approval
- [ ] All privileged sessions recorded and auditable
- [ ] Service accounts use dynamic credentials with short TTLs
- [ ] Break-glass procedure documented, tested quarterly
- [ ] Tiered model prevents lateral movement across tiers
- [ ] Orphaned privileged accounts removed

## References

- [NIST SP 800-53 AC-6 Least Privilege](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [Microsoft Tiered Admin Model](https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model)
- [CIS Controls v8 — Control 6: Access Control Management](https://www.cisecurity.org/controls/v8)
