01 / What each boundary answers
Compare the decision, not the label.
Controls access to privileged credentials, accounts or sessions and can record privileged activity.
Narrows what the agent may do with that access for a named task, target and time.
02 / Same operating case
Which request must be stopped?
A maintenance agent obtains a privileged session for a production cluster but is assigned to inspect one node.
Evaluation exercise
Use one vaulted privileged session for a read command and a restart command. Compare what the session manager records with what the target system can reject per command.
03 / Architecture fit
How the controls can compose
A PAM session can be an execution channel. An action gate in the protected command or API path should bind task and target.
Do not assume every PAM deployment exposes parameter-level interlocks inside a session.
04 / Evidence
Prove the decision and the effect separately.
Keep credential checkout and session evidence alongside decision, command and observed service state.
Primary sources