import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Surfaces impersonation / delegated-administration paths that bypass a user's
 * own credentials:
 *   - Delegated Administration groups (`DelegateGroup`): members can manage users
 *     and assign permissions within a scope — a lateral-movement / priv-esc path
 *     that admin-focused monitoring often misses.
 *   - "Administrators Can Log In as Any User" (org Login Access Policy): when on,
 *     any admin can impersonate any user and read all their data with no consent.
 *     This toggle is not cleanly API-exposed, so it is raised as an advisory.
 */
export declare class LoginAccessPolicyCheck implements SecurityCheck {
    readonly id = "login-access-policy";
    readonly name = "Login-As & Delegated Administration";
    readonly category = "Access Control";
    readonly description = "Flags delegated-administration groups and the org login-as policy, which allow user impersonation and scoped admin escalation that bypass normal credentials";
    run(ctx: AuditContext): Promise<CheckResult>;
    /**
     * "Administrators Can Log In as Any User". Read authoritatively from
     * SecuritySettings metadata when a Metadata client is available; otherwise fall
     * back to a manual-verification advisory.
     */
    private addLoginAsPolicyFinding;
}
//# sourceMappingURL=LoginAccessPolicyCheck.d.ts.map