A sudo rule allows the target subcommand while PAM account restrictions on time or host still block the noninteractive invocation during a staged decommission

Path authorization is correct, but session policy still denies execution. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.