A financial enterprise is updating its identity governance and privilege escalation policies across several Google Cloud production projects. The security team wants to eliminate permanent administrative role bindings, establish automated justification and approval workflows for time-bound access elevations integrated with their ITSM platform, and automatically detect when dormant service accounts are granted unauthorized impersonation roles. Which combination of Google Cloud features should the security engineer implement to satisfy these requirements?

Configure Privileged Access Manager (PAM) entitlements requiring justification and automated service account approvers for ITSM integration; monitor Security Command Center Event Threat Detection for dormant service account impersonation findings and apply IAM Recommender recommendations.: What Privileged Access Manager, Event Threat Detection, and IAM Recommender are Privileged Access Manager (PAM) is a Google Cloud-native service that manages just-in-time, temporary privilege elevation for principals based on defined entitlements. Security Command Center Event Threat Detection is a built-in threat intelligence engine that continuously analyzes Cloud Audit Logs to uncover anomalous IAM behaviors and policy violations, such as privileges granted on dormant accounts. IAM Recommender analyzes historical access patterns to detect excessive permissions and recommend least-privilege role adjustments. How it meets the requirements Automated justification and time-bound escalation: Privileged Access Manager allows administrators to define entitlements with strict maximum durations and mandate business justifications for every grant request. ITSM pipeline integration: PAM supports configuring service accounts as approvers, allowing automated CI/CD and ITSM systems (such as Jira or ServiceNow) to evaluate grant requests programmatically against open change tickets without requiring manual approval delays. Detecting dormant account policy violations: Event Threat Detection monitors Cloud Audit Logs and automatically generates findings such as Privilege Escalation: Impersonation Role Granted for Dormant Service Account when a principal gains impersonation rights over a service account inactive for more than 180 days. Least-privilege policy enforcement: Security teams can review and apply IAM Recommender role recommendations to remediate over-privileged role assignments and enforce least privilege. Key advantages and capabilities Just-in-Time (JIT) access: Eliminates standing administrative privileges by revoking temporary IAM role bindings automatically when grant durations expire. Automated approvals: Streamlines operations by delegating approval checks to automated service accounts in DevOps pipelines. Continuous threat detection: Provides real-time visibility into privilege escalation attempts targeting dormant or unmanaged identities. Comprehensive audit logging: Generates full audit trails of who requested access, the justification supplied, who approved the grant, and the specific resources modified. Why this is optimal This approach leverages native Google Cloud governance and security mechanisms to establish automated privilege escalation control, enforce least privilege, and detect dormant account risks without introducing custom management infrastructure.