[REVIEW] privileged-access: add PAM resilience and outage fallback evidence gates

[tzh476]

Skill Being Reviewed

Skill name: privileged-access
Skill path: skills/identity/privileged-access/SKILL.md

False Positive Analysis

Benign-looking PAM posture that can be over-scored as mature:

pam_tool:
  status: deployed
  vaulted_credentials: production_admins
  jit_workflow: approval_based
  session_recording: enabled
  break_glass:
    documented: true
    quarterly_tested: true
resilience_evidence:
  pam_control_plane_ha: unknown
  vault_replication: unknown
  idp_dependency_outage_runbook: missing
  failover_test_timestamp: missing
  fallback_mode_logging: missing

Why this is a false positive:

The skill can mark PAM, JIT, vaulting, session recording, and break-glass controls as present while missing whether the PAM control plane itself survives outages. If the PAM tool, vault backend, IdP, or session proxy is a single point of failure, a real incident can force broad standing-admin exceptions, unaudited offline credential use, or operational lockout. That posture should not score the same as a PAM deployment with tested HA/DR, fallback logging, and post-outage reconciliation evidence.

Coverage Gaps

Missed variant 1: PAM/vault HA exists on paper but no failover test proves credential checkout, JIT activation, session proxying, alerting, and audit export still work during primary-region or IdP outage.

Missed variant 2: Offline emergency access is available, but fallback use is not logged back into the PAM audit trail, does not trigger rotation after recovery, and has no reconciliation owner.

Missed variant 3: PAM outage runbooks create temporary standing privileged groups or local admin exceptions without expiry, cleanup evidence, or a denial test showing normal PAM bypass is closed after recovery.

Edge Cases

• Small environments may accept manual fallback, but the review still needs evidence for custody, time limit, post-use rotation, and reconciliation.
• Cloud-native PAM may rely on regional managed-service resilience; reviewers should capture provider SLA/region scope and test evidence rather than assuming resilience from product branding.
• Break-glass can be valid during PAM outage, but only if it is constrained, monitored, and followed by post-use rotation and audit backfill.

Remediation Quality

• Fix resolves the vulnerability
• Fix doesn't introduce new security issues
• Fix doesn't break functionality
• Issues found: Add a dedicated PAM resilience/outage fallback evidence section, finding IDs, maturity/report fields, and common pitfalls so reviewers do not treat a deployed PAM tool as mature without HA/DR proof.

Comparison to Other Tools

Tool	Catches this?	Notes
Semgrep	No	This is governance/control-plane evidence, not source-code pattern matching.
CodeQL	No	CodeQL cannot verify PAM outage runbooks, vault replication, failover tests, or audit backfill.
PAM vendor reports	Partial	Vendor dashboards may show component health but usually do not prove customer failover drills and reconciliation controls.
GRC control tests	Partial	Can capture DR controls, but they often do not connect outage fallback to privileged-access evidence chains.

Overall Assessment

Strengths: The skill already covers inventory, PAM tool maturity, JIT, break-glass, session recording, and vaulting.

Needs improvement: It lacks a dedicated gate tying PAM control-plane resilience to privileged-access assurance, so a single-region or IdP-dependent PAM deployment can be over-scored.

Priority recommendations:

1. Add PAM HA/DR and outage fallback evidence requirements.
2. Add findings for untested failover, unaudited fallback, unbounded temporary standing privilege, and missing post-outage reconciliation.
3. Add output fields so reports show PAM control-plane RTO/RPO, last failover test, fallback mode, reconciliation owner, and residual risk.

Bounty Info

• I have read and agree to the CONTRIBUTING.md bounty terms
• Preferred payment method: PayPal tzh476@gmail.com

[tzh476]

Follow-up implementation PR submitted: #801

Preferred payment method is PayPal; I can provide payment details privately through the maintainer-requested channel.