---
title: Commmand Policy
slug: kronpam-agent-reference-guide-3-9-0/commmand-policy
createdAt: 2026-06-24T09:09:34.566Z
---

The "reboot" command might be blocked for all users globally, but through an **Advanced Policy**, we can grant the "Linux Administrator" group permission to use it. If an advanced rule exists for a command, it overrides the general policy for those specific users, and the advanced rule takes precedence.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/GCX4SvRFMr9sZMUPEULU3_image.png "Advance Policy")

To create an **Advanced Policy**, click the **ADD** button in the top-right corner of the screen and proceed by filling in the required information.

1.      **First Step:** You must assign a name to the Advanced Policy and select the specific **users or user groups** to whom this policy will apply.

2.      **Second Step:** You add the specific command to be governed by the policy, along with any necessary details (parameters, paths, etc.).

3.      **Third Step:** You must select the policy type. There are three options available, and the subsequent steps vary slightly based on your choice:

a.      **Allow:** If selected, you will be asked to specify the **endpoints** where this policy is valid and define the behavior for **subprocesses**.

b.      **Block:** If selected, you must specify the relevant **endpoints** and decide whether or not to display a **warning notification** to the end user when the command is blocked.

c.      **Elevation:** If selected, you will define the target **endpoints** and **subprocess** behavior. Most importantly, you must configure the approval mechanism: whether the command requires **OTP (One-Time Password)**, **Managerial Approval**, or both.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/kzV_DV6H4KBhsXb1U2rln_image.png "Choosing the User / User Group in Advance Policy")

:::hint{type="info"}
When selecting users in **Advanced Policy**, the listed users are those who have been imported into **Kron PAM** from **Active Directory**. Local users are not populated or displayed in this section.
:::

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/lNEYQXsCNbEGbPCGDPTct_image.png "Entering Command related parameters")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/KQEIVNM_TcLtiZGhBainp_image.png "Choosing Policy in Advance Policy")

If Allow policy is selected, the steps below will be configured.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/29_0AlAuV0EJCzLQcQyr-_image.png "Choosing Endpoints to apply the Advance Policy")

:::hint{type="info"}
If "Apply to All Agents" is selected, the policy will be **received by **every endpoint where an agent is installed.
:::

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/P8XHtCcgjIneLUALWZBMX_image.png "Choosing the Subprocess policy in the case of Allow Advance policy")

If Block policy is selected, the steps below will be configured.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/_dR7jRAJDIxPVsaXy7vLk_image.png "Choosing Endpoints to apply the Advance Policy")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/bWD-EymNNDJUslZEwEy2e_image.png "Choosing whether to display warnings to the End User or not")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/iLA2y8648LMM-Mef_EBgE_image.png "Choosing the Elevation type for Block Advance Policy")

If Elevation policy is selected,the steps below will be configured.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/CUOplMmiv0R-eR6-OnHB__image.png "Choosing Endpoints to apply the Advance Policy")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/2Z_l-i7mCCECXnz8h6YKn_image.png "Choosing the Subprocess policy in the case of Elevated Advance policy")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/zxL61oy9XbuAd6XJ15YEQ_image.png "Choosing the Elevation type in Advance Policy")

### Adding Multiple Applications to an Advanced Policy

An advanced policy applies to one or more applications or commands. To add another application to the same policy, click **Add Application** on the **APPLICATION INFO** step. Each application appears in its own **Application Info** section. To remove an application, click the delete icon next to its section.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/akeqLLdC6i7-XHMMssjfu_image.png "Figure – Adding two applications to an advanced policy")

The policy action applies to every application or command in the policy. In the following example, an advanced policy blocks the *date* and *mkdir* commands for the *demo\_user1* user on the *kronpam-agentRHEL9* agent. When the user runs either command, the agent blocks it and returns the name of the rule:

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/grnYiBJWudIVk5JJv5fbM_image.png "Figure – Two commands blocked by the same advanced policy\[")

**Running Applications with Sudo Rights in Advanced Policy**



The **Sudo Right** option defines whether users complete an additional verification when they run an application with sudo. The option appears on the **POLICY ACTION** step after you select **Allow** as the policy action in advanced policy.

Enable **Sudo Right** to let the users that the policy applies to run the application with sudo directly:

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/27AJBCuFGICjr_nt38dgh_image.png "Figure – Enabling the Sudo Right option in an advanced policy")

Disable **Sudo Right** to apply the standard elevation flow. The agent then asks the user for verification before it runs the application:

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/TsdQgecAcLbIAW7Hx8GYY_image.png "Figure – Disabling the Sudo Right option in an advanced policy")

The following example shows both behaviors for the *demo\_user1* user on the *kronpam-agentRHEL9* agent. While **Sudo Right** is disabled, the agent asks for the elevation period, and the *date* command exits after three incorrect entries. After you enable **Sudo Right**, the same command runs immediately:

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/W8ouoJYS9zUiIUtnYJYh-_image.png "Figure – Running the date command with sudo on a Linux agent\[")