AAA succeeds on the core path while device admin sourced from an out-of-band interface now hits a different policy realm than production traffic during a staged decommission

The server is reachable, yet the management path is classified into the wrong authorization domain. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.