Not all runtime privilege protection evaluates the same way. The difference between trusting a parent process versus evaluating every individual execution is a security architecture decision with real consequences — and most practitioners never ask which model their tool uses.
Traditional PAM is essential, but it is incomplete by design. It controls what credentials get accessed and by whom. Runtime privilege protection is a different layer — it governs what gets to execute, at what privilege level, and under what conditions. These are not the same problem.
Within runtime protection, two distinct evaluation models exist. The first evaluates the initial execution — the parent process — and cascades that determination to all child processes through a policy ticket. The parent is trusted; everything spawned from it inherits that trust. The second model evaluates each command or execution independently, regardless of what launched it.
The architectural difference sounds subtle. The security difference is not.
A legitimate, trusted parent process is compromised mid-session. The attacker uses it to spawn a child process — a shell, a script, a payload. Under the first model, that child inherits the parent's determination. The trust chain holds. The execution proceeds at elevated privilege.
Under the second model, the child process is evaluated independently. It has no earned trust. The chain breaks exactly where the compromise occurred.
This is not a theoretical edge case. It is a practical architectural question that determines whether your runtime controls hold when a real attacker finds a foothold. Hundreds or thousands of process executions happen faster than you can read this article. The evaluation model your endpoint privilege management tool uses determines whether each one of those is trusted on its own merits or inherited from whatever came before it.
Ask the question. Know the answer before an incident makes the answer obvious.
Disclosure
The author works for Delinea, a PAM vendor with endpoint privilege management capabilities. This article does not evaluate or endorse any specific vendor solution.