Remote Assist (RA) Overview: Remote Assist is a secure, customer-initiated tunnel that allows Pure Storage Technical Support Engineers (TSEs) to log into a FlashArray to perform diagnostics and maintenance. It is disabled by default and must be explicitly opened by the customer.

Access Modes in Purity: In modern Purity versions (like 6.8.4), Pure Storage has introduced granular access controls for these support sessions to satisfy enterprise security and compliance requirements (such as SOC2 or HIPAA).

Restricted Access: This mode is specifically designed for high-security environments. When RA is enabled with the Restricted flag, the Support Engineer is limited to a pre-defined subset of non-destructive, read-only, or diagnostic commands. They cannot perform major configuration changes, delete data, or access sensitive metadata without further authorization.

Elevated vs. Secured: * Elevated access (often used during emergency recovery) provides the TSE with broader permissions, including the ability to run system-level scripts and configuration commands that go beyond standard diagnostics.

Secured is often a baseline state but does not imply the specific command-level filtering that 'Restricted' does.

Security Best Practice: If a security team mandates that 'only certain commands can be executed,' Restricted is the correct administrative choice. This ensures that the principle of least privilege is applied even to the vendor's support staff.