PAM

14:09:59 · inside

1. Scope. Sam approves R160 restart authority within a ten-minute window. Maya’s ordinary session remains valid; it does not itself grant restart authority. The approval is Maya, restart, R160 and September 30 14:00 inclusive–14:10 exclusive UTC. The selected service models restart with a counter, not an OS process. Ordinary status reading is already permitted. Operator authentication, protected channels, exact approval and trustworthy target time are assumed. No temporary grant or operation exists yet.
2. Elevate. The trusted access service admits the exact approved scope and issues temporary grant J160. No restart has run. At 14:00 the access service checks Maya, Sam’s actual approval, the restart action, R160 and the window before issuing J160. The target is configured to consult this trusted grant on each privileged request. Issuance does not execute the maintenance task or confer export/other-service rights. A claimed approval or altered target cannot create this grant.
3. Work. At 14:09:59 the target permits the exact restart and writes A160. One restart is recorded. The target validates the held J160, actor, action, resource and its own request time before changing the selected counter and recording A160. 14:09:59 is inside the window; 14:10:00 is the exclusive end. Both runs retain valid ordinary authentication and original approval. This chapter combines the target’s operation and audit write, not delivery to another analyst.
4. Check expiry. A fresh restart request at 14:10 is refused. Ordinary status reading still succeeds, and the original approval and A160 remain. Independent requests at 14:10 test the selected expired restart right and ordinary status access. They return 403 with no further restart and 200 status respectively in both runs. The earlier permitted run retains one restart; the at-expiry run retains zero. J160 remains as a record of bounded authority, not an active privilege. Expiry does not reverse earlier work or prove every management route is closed.

14:10:00 · expired

1. Scope. Sam approves R160 restart authority within a ten-minute window. Maya’s ordinary session remains valid; it does not itself grant restart authority. The approval is Maya, restart, R160 and September 30 14:00 inclusive–14:10 exclusive UTC. The selected service models restart with a counter, not an OS process. Ordinary status reading is already permitted. Operator authentication, protected channels, exact approval and trustworthy target time are assumed. No temporary grant or operation exists yet.
2. Elevate. The trusted access service admits the exact approved scope and issues temporary grant J160. No restart has run. At 14:00 the access service checks Maya, Sam’s actual approval, the restart action, R160 and the window before issuing J160. The target is configured to consult this trusted grant on each privileged request. Issuance does not execute the maintenance task or confer export/other-service rights. A claimed approval or altered target cannot create this grant.
3. Work. At 14:10:00 the target refuses the same restart because the window has ended. A160 records refusal; no restart occurs. The target validates the held J160, actor, action, resource and its own request time before changing the selected counter and recording A160. 14:09:59 is inside the window; 14:10:00 is the exclusive end. Both runs retain valid ordinary authentication and original approval. This chapter combines the target’s operation and audit write, not delivery to another analyst.
4. Check expiry. A fresh restart request at 14:10 is refused. Ordinary status reading still succeeds, and the original approval and A160 remain. Independent requests at 14:10 test the selected expired restart right and ordinary status access. They return 403 with no further restart and 200 status respectively in both runs. The earlier permitted run retains one restart; the at-expiry run retains zero. J160 remains as a record of bounded authority, not an active privilege. Expiry does not reverse earlier work or prove every management route is closed.

This is one temporary app-level privilege under assumed authentication, protected channels and trusted service time. J160 is a correlation label, not a credential value. Expiry denies new selected requests; it does not undo completed work, stop an operation already running or prove every alternate administration path is closed.

Flow references: NIST SP 800-53: account reviews, privilege and dynamic access · OWASP: enforce permission on every request