jp2000
Grant permissions on sub-entries without requiring read access on parent folders
Summary Currently it appears that you cannot explicitly grant "Connect/View" permissions on a sub-entry without also granting "View" permission on the parent folder containing that entry. I'd like to be able to permission an individual entry directly, so a user can see and connect to only that specific entry, without being granted read access to the parent folder (and by extension visibility of the folder's other contents).
Example
Folder: SERVER
Entry: SVC-1
Entry: SVC-2
Entry: SVC-3
The user should be able to view and connect to SVC-2 only — not SVC-1, not SVC-3, and ideally without needing broad read access on the SERVER folder itself.
Current behavior To grant "Connect/View" on a sub-entry, the user must also be given "View" on the parent folder, which exposes the folder structure and potentially other entries.
Proposed behavior Allow assigning "Connect/View" permissions directly on an individual entry, independent of the parent folder's permissions. The folder would surface only as the minimal path needed to reach the permitted entry, without granting visibility into its other contents.
Benefit Enables true least-privilege access at the entry level, avoiding over-provisioning of folder-level read access just to expose a single entry.
Skip PAM checkout replication delay on subsequent checkouts while access is still active
Summary When performing a PAM checkout, RDM allows configuring a delay to ensure replication completes before the credential is used. Currently this delay is applied on every checkout request. I'd like the delay to only be enforced on the first checkout. As long as the JIT (just-in-time) elevation is still in place and the user still has an active checkout, the delay should be skipped on subsequent requests, since replication has already occurred and waiting again is unnecessary.
Current behavior The configured replication delay is applied on each checkout request, regardless of whether the user already has an active/valid checkout and the JIT elevation is still present.
Proposed behavior Apply the replication delay only on the initial checkout. On any subsequent checkout request, if the JIT elevation is still active and the user is still checked out, skip the delay and grant access immediately.
Benefit Avoids redundant waiting time on repeated checkouts when replication has already completed, improving the user experience without compromising the replication guarantee.