The system now provides several types of passwords users can enter depending on their intended action—the Privileged Access Token serves as the emergency password, the Privileged Access one-time password (OTP) for executing privileged operations, and operation-specific OTPs for targeted operations like disabling or uninstalling the agent. This hierarchy of passwords replaces the previous single-password validation where a correctly entered password granted universal access.

The system automatically provides and refreshes unique OTPs per user or user group and operation type, replacing the manual password management where administrators set a single static password across all devices. The system invalidates OTPs immediately after each use, eliminating the previous behavior where passwords remained valid indefinitely until manually changed.

Successful authentication with the Privileged Access Token or Privileged Access OTP now starts a configurable time window during which additional privileged operations don’t require reauthentication. The default tamper protection autoenable duration is 30 minutes. After this duration has elapsed, the anti-tamper protection will automatically reenable. The previous behavior required password entry for every privileged operation regardless of timing or previous authentication status.