An administrative domain is a trust boundary that groups related permissions and control functions. Systems and accounts within the domain are managed under a shared authority, while separate domains have distinct administration and access controls.
This boundary matters because an attacker who gains control of one domain may be able to affect everything it governs. In cloud environments, separating customer-facing services, production systems, and backups into distinct administrative domains can limit an incident’s reach. Use separate privileged accounts and management paths, and ensure that a compromised console or credential cannot control both production and recovery systems.