Privileged Access Management

Standing administrative power is minimized; elevated access is granted just-in-time, scoped, time-boxed, and fully recorded, then automatically revoked.

No permanent superusers

Persistent administrative accounts are a standing liability: if compromised, they hand an attacker durable control. Kronos removes standing privilege from control systems. Elevated capability is requested for a specific task, granted for a bounded window, scoped to the minimum systems needed, and revoked automatically when the window closes. The default state of every account is low privilege.

Just-in-time elevation

# JIT grant: scoped, time-boxed, second-party approved for high tiers
def grant(request):
    if request.tier == 'high' and not two_person_ok(request):  # SoD
        return DENY
    lease = Lease(scope=request.scope,
                  ttl=min(request.ttl, policy.max_ttl(request.tier)),
                  identity=request.who)
    audit('grant', lease)
    schedule_revoke(lease)       # auto-expire, no manual cleanup needed
    return lease

Controls layered on top

• Scope: a lease opens only the specific controllers or services the task needs, honoring microsegmentation.
• Time-box: leases expire; there is no lingering access to forget to remove.
• Second party for high tiers: elevation to safety-adjacent systems needs separation of duties.
• Session recording: privileged sessions are captured into the audit log.
• Break-glass: emergency access exists but is loud - it triggers alerts and mandatory review.

Interaction with identity

Privilege decisions consume the verified identity from zero-trust identity; a lease is meaningless without a proven, attested principal. Combined with short-lived credentials, a revoked lease takes effect within the credential's brief lifetime.

Design status: the JIT engine, lease lifecycle, and session recording run against the twin. Break-glass procedures and the operator-facing request workflow are defined for plant operation; they are not yet governing access to a live reactor.