[soroshsabz]

Summary

Draft RFC for Just Enough Administration (JEA) on Linux, from the discussion in PowerShell/PowerShell#2198.

The RFC proposes a cross-platform, design-first evolution of JEA that makes role-based constrained PowerShell endpoints possible on Linux (and over SSH on all supported platforms), filling the gap that RFC0064 deliberately left open:

• Connection authorization — RoleDefinitions/RequiredGroups in .pssc currently error with pwsh -ConfigurationFile; the RFC proposes platform-neutral principal resolution (Windows SIDs; Linux/macOS users and groups via NSS) and deny-by-default endpoint access for unmapped principals.
• Privilege delegation — an explicit, auditable elevation model integrating with sudo allowlists, systemd/polkit, file capabilities, and privileged helper daemons, rather than inventing a new privilege mechanism.
• Endpoint lifecycle tooling — cross-platform *-PSSessionConfiguration cmdlets that manage sshd_config subsystem endpoints, validate .pssc/.psrc files, and enforce endpoint resource ownership.
• Native command policy, escape prevention, and auditing — default-deny VisibleExternalCommands with argument validation, a threat model for constrained endpoints over SSH, and structured syslog/journald audit events.
• JEA v2 framing — features that could flow back to Windows, as discussed in JEA on Linux PowerShell#2198 (also relevant to JEA session configuration breaks after upgrading past 7.2.1 PowerShell#17367).

Process notes

• Submitted as a draft PR into Draft-Accepted per RFC0000; the RFC number is intentionally left blank and the filename keeps NNNN for the Committee to assign (maintainer edits are allowed).
• The WG has not formally requested an RFC for JEA on Linux PowerShell#2198 yet; this draft is intended to serve as the design investigation the collaborators asked for in that discussion ("clarity over the design… then PRs can come"). Happy to hold, adjust, or restructure (e.g., into a separate JEA v2 spec repo as also suggested) per WG guidance.
• Scope questions are collected in the Open questions section precisely so the Committee/WG can steer the design before any implementation.

Related

• JEA on Linux PowerShell#2198
• RFC0064 (PowerShell Local Session Configuration), RFC0010 (SSH Remoting Cmdlets)

cc Steve Lee (@SteveL-MSFT) Thomas Lee (@doctordns) Ryan Yates (@kilasuit) (participants in the #2198 discussion)

---

This change is 

[soroshsabz]

Seyed Mehran Siadati (@siadatism) Please review this PR and make sure all your requirements are met in this RFC.

[soroshsabz]

Ryan Yates (@kilasuit) As I understand it PRs in this repo must remain in draft until you say otherwise, Am I correct?