<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Privileged Access Architecture — API Reference

## agent.js CLI

```bash
# Audit current privilege assignments
node scripts/agent.js --action audit --directory users.json

# Design tiered admin model
node scripts/agent.js --action design --audit audit-results.json --output tiers.json

# Generate PAM policies
node scripts/agent.js --action policies --tiers tiers.json --output pam-policies.json

# Validate policy compliance
node scripts/agent.js --action validate --policies pam-policies.json
```

## User Directory JSON Schema

```json
{
  "name": "admin-alice",
  "roles": ["domain-admin", "server-admin"],
  "standing_access": true,
  "active": true,
  "last_login_days_ago": 5
}
```

## Tier Definitions

| Tier | Scope | Max Session | MFA | PAW Required |
|------|-------|-------------|-----|--------------|
| 0 | Identity infrastructure | 2 hours | Hardware | Yes |
| 1 | Server/application admin | 4 hours | Hardware | No |
| 2 | Workstation/user support | 8 hours | Software | No |

## PAM Policy JSON Schema

```json
{
  "name": "tier1-policy",
  "tier": 1,
  "max_duration_hours": 4,
  "require_approval": false,
  "mfa_required": true,
  "session_recording": true,
  "jit_enabled": true,
  "auto_revoke": true,
  "scope": ["app-servers", "databases"]
}
```
