Forced SSH commands need a complete key policy, not just restricted options

An authorized_keys entry can limit a public key to one fixed command and disable features such as terminal allocation and forwarding. These restrictions are useful for backup agents, deployment hooks, and narrow administrative tasks, but they do not amount to full authorization on their own. The command, the key owner, the inherited environment, and the server configuration all determine what a key can actually do. Experts advise using separate service accounts for integrations with different privilege levels, validating any client-supplied input with a narrow grammar rather than passing it to a shell, and testing effective behavior after upgrades or configuration changes. They also recommend tracking each key's owner, purpose, and review date, rotating keys on a schedule, and logging authentication events without recording secrets.