Role Separation

You define what counts as user functionality and what counts as system management.

Objectives [a] and [b] are definitions you write, and the definitions frame the assessment. Defining system management functionality as domain and tenant administration and user functionality as what a standard account can do is a workable framing. A least-privilege paragraph that never says what either term means gives the assessor nothing to test [c] against.

Separate accounts enforce the separation. Separate networks are optional.

The requirement allows physical or logical separation, and logical separation through access control is the ordinary implementation. Administrators hold a standard account for daily work and a privileged account for administration, and standard accounts cannot reach the administrative functions. This is the same account discipline AC.L2-3.1.6 requires, evidenced from the other side.

Prove [c] by showing what a standard user cannot do.

A demonstration that a normal account cannot open the admin center, install software, or reach management interfaces is direct evidence. Pair it with the definitions and the account inventory, and the requirement is covered without new infrastructure.

Jump servers and privileged access management platforms are upgrades, not requirements.

A dedicated administration host confines privileged sessions, and a privileged access management tool adds checkout and recording. Both earn roadmap space in a larger environment. Neither is needed to meet the objectives when account separation is clean.