[REVIEW] privileged-access: add direct PAM bypass reconciliation gates

[malb200710-dev]

Skill reviewed

skills/identity/privileged-access/SKILL.md

Gap

The current PAM review flags bypass paths, but it does not require evidence that PAM/JIT records reconcile against native platform logs. A PAM deployment can report high onboarding coverage while direct SSH, RDP, cloud console, database admin, Kubernetes, or local break-glass paths still allow privileged actions outside the broker.

False-positive scenario

An assessor accepts the PAM console's account coverage report as proof that privileged access is controlled. Native logs later show administrator sessions on production systems with no matching PAM session, approval, checkout, JIT activation, or emergency record.

Missed variants

• Direct SSH/RDP/database admin ports remain reachable from administrator workstations while PAM is deployed in parallel.
• Cloud admin roles are assumed through access keys, console sign-in, or alternate IdP paths that never traverse PAM/PIM.
• Kubernetes cluster-admin actions happen through unmanaged kubeconfigs outside the broker.
• Local admin accounts and service identities are excluded from onboarding metrics but still perform privileged actions.
• SIEM ingests PAM logs and native logs but does not correlate unmatched privileged events.

Edge cases

Emergency access paths can exist, but they need expiry, ticketing, monitoring, and post-use reconciliation. Native events should match an approved PAM/JIT/emergency record within an expected time window, or produce an alert.

Proposed remediation

Add a direct access bypass evidence gate comparing PAM/JIT logs with native platform logs, network path restrictions, reconciliation tables, SIEM correlation expectations, output scorecard fields, and version history.

Bounty note

If accepted under the project bounty terms, payment details can be provided privately through the maintainer's preferred channel.

[malb200710-dev]

Implemented this review as PR #2294: #2294

Scope: direct access bypass evidence gate comparing PAM/JIT records with native platform logs, network path restrictions, SIEM correlation, reconciliation table, and output scorecard fields.

[JamesJi79]

/attempt #2293

Will submit VALID GAP analysis shortly.

[JamesJi79]

/attempt #2293

VALID GAP - privileged-access: add direct PAM bypass reconciliation gates

Why Valid (FP confirmed)

The issue correctly identifies that a PAM console coverage report without cross-referencing native platform logs can create a false sense of security. An assessor who sees high PAM onboarding numbers and marks privileged access as controlled is making a false-positive assumption when native logs show direct SSH/RDP/cloud console/admin paths that never traverse the broker. The current SKILL.md checks for PAM existence but lacks the reconciliation evidence layer.

Coverage Gaps

Gap 1 - Direct SSH/RDP bypass - Administrator workstations can retain direct connectivity to production systems on standard admin ports (22, 3389) while PAM is deployed in parallel, creating a bypass path that PAM coverage metrics miss entirely. Need gate: Evidence that network segmentation or host-level controls prevent direct admin port access outside the PAM broker.

Gap 2 - Cloud console and access-key bypass - Cloud IAM roles can be assumed through console sign-in, access keys, or alternate IdP paths that never traverse PAM/PIM. A reviewer relying on PAM coverage alone would miss these. Need gate: Evidence that cloud privileged roles are only assumable through PAM/PIM approval workflows.

Gap 3 - SIEM correlation gap - Even when both PAM logs and native platform logs are ingested into SIEM, the lack of correlation rules for unmatched privileged events means bypasses go undetected. Need gate: Evidence of SIEM correlation rules that flag privileged actions without a matching PAM session/approval record.

Suggested Gates

PAM-REC-01: Direct access restriction - Evidence that network ACLs, host firewalls, or endpoint controls block SSH/RDP/database admin ports from non-PAM sources to production targets. Source: network segmentation diagram, firewall rule review, or endpoint DLP scan.

PAM-REC-02: Cloud PIM onboarding - Evidence that all cloud privileged roles (Owner, Admin, Contributor-equivalent) are scoped to PAM/PIM approval workflows and that access keys for these roles are rotated or disabled. Source: IAM role trust policy review, PIM activation reports.

PAM-REC-03: SIEM correlation - Evidence that the SIEM has correlation rules matching native authentication/action logs against PAM session and approval records, with configured alerting for unmatched privileged events. Source: SIEM correlation rule review, test alert output.