Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions rfcs/text/0051-user-is-privileged.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,15 @@
# 0051: Add user.is_privileged boolean field

- Stage: **0 (strawperson)**
- Date: **2025-07-28**
- Stage: **X (abandoned)**
- Date: **2025-08-11**

This RFC proposes adding a new boolean field, `user.is_privileged`. It will explicitly flag when a user has elevated or administrative rights such as ability to grant permissions, perform `sudo`, or manage IAM roles—so analysts can more easily filter, alert on, and correlate privileged‐user activity without custom parsing.

## Stage X

This RFC is not being worked on actively, and it has been marked as abandoned. If an individual wishes to advance it in the future, open a new pull request against this proposal.


## Fields

```yaml
Expand Down