diff --git a/doc/aaa/TACACS+ Trace ID.md b/doc/aaa/TACACS+ Trace ID.md
new file mode 100644
index 00000000000..2ffe7c1121d
--- /dev/null
+++ b/doc/aaa/TACACS+ Trace ID.md	
@@ -0,0 +1,580 @@
+# TACACS+ TraceId Command Authorization HLD
+
+## Table of Contents
+
+- [1. Revision](#1-revision)
+- [2. Introduction and Motivation](#2-introduction-and-motivation)
+- [3. Scope](#3-scope)
+- [4. Definitions/Abbreviations](#4-definitionsabbreviations)
+- [5. Overview](#5-overview)
+- [6. Requirements](#6-requirements)
+- [7. Architecture Design](#7-architecture-design)
+- [8. High-Level Design](#8-high-level-design)
+- [9. SAI API](#9-sai-api)
+- [10. Configuration and management](#10-configuration-and-management)
+- [11. Warmboot and Fastboot Design Impact](#11-warmboot-and-fastboot-design-impact)
+- [12. Memory Consumption](#12-memory-consumption)
+- [13. Restrictions/Limitations](#13-restrictionslimitations)
+- [14. Testing Requirements/Design](#14-testing-requirementsdesign)
+- [15. Open/Action items](#15-openaction-items)
+- [16. References](#16-references)
+
+## 1. Revision
+
+| Revision | Date | Author | Description |
+| --- | --- | --- | --- |
+| 0.1 | 2026-05-28 | Rod Persky | Initial TraceId proposal. |
+| 0.2 | 2026-07-09 | Rod Persky | Changed TraceId environment variable to `SSH_CLIENT_TRACEID` and added YANG configuration support. |
+
+## 2. Introduction and Motivation
+
+Operators often need to reconstruct what happened during a specific access session or automation workflow, not only what commands were observed on a device. In many environments, the device-side TACACS+ authorization logs and the access proxy or automation logs are stored in separate systems. Today, TACACS+ command authorization records identify the user and command, but they do not carry an end-to-end correlation value supplied by the client workflow.
+
+This creates disjoint audit trails. For a user session through an access proxy service, TACACS+ can show the commands executed on the device, while the proxy can show the approved access session and any session recording. Without a shared correlation value, it is difficult to answer which recorded session produced a specific device command. For automation, TACACS+ may show only the automation account that executed commands on behalf of a user or service. Without a shared correlation value, it is difficult to tie those commands back to the workflow request, requester, approval context, or reason the workflow was executed.
+
+`TraceId` provides a shared join key for these records. An access proxy or automation system generates a `TraceId`, injects it into the SSH session, preserves the same value in its own logs, and SONiC copies the validated value into every TACACS+ command authorization request for that session. A TACACS+ server or downstream log pipeline can then correlate device command authorization records with external access-session, session-recording, incident-response, or automation-run records.
+
+This feature is intentionally limited to command authorization correlation. Authorization is the point where `bash_tacplus` already evaluates each command and sends command-specific metadata to TACACS+. Adding `TraceId` there gives operators per-command correlation without changing login behavior, TACACS+ server configuration, or command allow/deny semantics. `TraceId` is optional, untrusted metadata; the selected design uses standard OpenSSH environment propagation and a small `bash_tacplus` authorization change while preserving existing behavior when `TraceId` is absent or invalid.
+
+## 3. Scope
+
+This HLD defines how SONiC propagates a client-supplied SSH trace identifier from `SSH_CLIENT_TRACEID` into TACACS+ command authorization requests generated by `bash_tacplus` as the lowercase `traceid` AV attribute.
+
+### 3.1 In scope
+
+- Accept a client-supplied SSH environment variable named `SSH_CLIENT_TRACEID`.
+- Preserve the variable in the user's initial interactive bash shell with a best-effort `readonly` guard.
+- Validate `SSH_CLIENT_TRACEID` before it is added to a TACACS+ request.
+- Add a `traceid=<value>` attribute to TACACS+ command authorization requests.
+- Add a TACACS+ global configuration option to enable or disable sending `traceid`.
+- Keep existing command authorization behavior unchanged when `TraceId` is absent or invalid.
+- Add unit, integration, and regression tests for the authorization path.
+
+### 3.2 Out of scope
+
+- Changes to other TACACS+ packet types or other AAA flows.
+- Changes to local Linux audit records.
+- Changes to OpenSSH client behavior.
+- A tamper-resistant root-owned per-session state store.
+- New APP_DB, STATE_DB, or platform DB schema.
+- SAI, SWSS, syncd, ASIC, or platform driver changes.
+
+## 4. Definitions/Abbreviations
+
+| Term | Definition |
+| --- | --- |
+| TraceId | Client-provided correlation identifier for an SSH session. |
+| `SSH_CLIENT_TRACEID` | SSH environment variable used to carry a TraceId value into the SONiC login session. |
+| TACACS+ | Terminal Access Controller Access-Control System Plus. |
+| AV pair | TACACS+ attribute-value pair encoded as `name=value`. |
+| traceid | TACACS+ AV attribute name used to carry a validated `TraceId` value. |
+| `bash_tacplus` | SONiC bash plugin that performs per-command TACACS+ authorization. |
+| `AcceptEnv` | OpenSSH server option that permits selected client environment variables. |
+| `SetEnv` | OpenSSH client option that sends an explicit environment variable to the server. |
+| `SendEnv` | OpenSSH client option that sends matching local environment variables to the server. |
+| HLD | High Level Design. |
+
+## 5. Overview
+
+SONiC supports TACACS+ command authorization through `bash_tacplus`. When a TACACS+ user runs a command in bash, the plugin builds a TACACS+ authorization request and sends command metadata such as `task_id`, `protocol`, `service`, `cmd`, and `cmd-arg`. This device-side record can then be correlated with external access proxy or automation records when a shared `TraceId` is present.
+
+This design adds one optional authorization attribute:
+
+```text
+traceid=<trace-id>
+```
+
+In this design, the SSH client sends `SSH_CLIENT_TRACEID` as an environment variable, SONiC sshd accepts the variable, bash inherits it, bash startup marks it `readonly` as a best-effort guard, and `bash_tacplus` includes the validated value in each command authorization request.
+
+```text
+SSH client
+  |
+  | OpenSSH environment propagation (SetEnv/SendEnv SSH_CLIENT_TRACEID=<trace-id>)
+  v
+sshd with AcceptEnv SSH_CLIENT_TRACEID
+  |
+  | user environment
+  v
+bash startup marks SSH_CLIENT_TRACEID readonly
+  |
+  | command execution
+  v
+bash_tacplus validates SSH_CLIENT_TRACEID
+  |
+  | tac_add_attrib(&attr, "traceid", trace_id)
+  v
+TACACS+ authorization server
+```
+
+The detailed server configuration, client syntax, configuration knob, bash guard, validation, and request-construction behavior are defined in [8.1 SSH server configuration](#81-ssh-server-configuration) through [8.7 `bash_tacplus` implementation](#87-bash_tacplus-implementation). The important limitation is that this is correlation metadata, not tamper-resistant audit identity; see [13. Restrictions/Limitations](#13-restrictionslimitations).
+
+## 6. Requirements
+
+### 6.1 Functional requirements
+
+| ID | Requirement |
+| --- | --- |
+| FR1 | SONiC sshd must accept a client-supplied environment variable named `SSH_CLIENT_TRACEID`. |
+| FR2 | `bash_tacplus` must add `traceid=<value>` to TACACS+ command authorization requests when a valid value is available. |
+| FR3 | `bash_tacplus` must omit the `traceid` attribute when the variable is unset, empty, or invalid. |
+| FR4 | Existing authorization attributes and ordering of command arguments must remain unchanged except for the new optional `traceid` attribute. |
+| FR5 | Existing command authorization success, failure, timeout, and failover behavior must remain unchanged. |
+| FR6 | Local users and sessions that do not provide `SSH_CLIENT_TRACEID` must continue to behave as they do today. |
+| FR7 | The implementation must be idempotent and must not duplicate sshd configuration entries. |
+| FR8 | SONiC must provide a TACPLUS global configuration option to enable or disable adding `traceid` to TACACS+ authorization requests. |
+| FR9 | `bash_tacplus` must omit `traceid` when the configuration option is disabled, even if `SSH_CLIENT_TRACEID` is present and valid. |
+
+### 6.2 Security requirements
+
+| ID | Requirement |
+| --- | --- |
+| SR1 | Treat `SSH_CLIENT_TRACEID` as untrusted client input. |
+| SR2 | Enforce a maximum value length before calling `tac_add_attrib()`. |
+| SR3 | Reject control characters, whitespace, equals signs, and shell/parser-sensitive characters. |
+| SR4 | Do not transform, truncate, or normalize a supplied `SSH_CLIENT_TRACEID`; either send the exact valid value or omit the attribute. |
+| SR5 | Do not log raw invalid `SSH_CLIENT_TRACEID` values at info, warning, or error levels. |
+| SR6 | Clearly document that the selected design provides only best-effort protection against accidental shell changes. |
+| SR7 | The `traceid_authorization` option must default to enabled and allow operators to explicitly disable honoring client-supplied correlation metadata. |
+
+### 6.3 Compatibility requirements
+
+| ID | Requirement |
+| --- | --- |
+| CR1 | SSH login must continue to work for clients that do not send `SSH_CLIENT_TRACEID`. |
+| CR2 | TACACS+ authorization must continue to work with servers that ignore unknown attributes. |
+| CR3 | Existing OpenSSH hardening settings must remain intact. |
+| CR4 | Existing TACACS+ server configuration and AAA CLI behavior must not change. |
+
+## 7. Architecture Design
+
+### 7.1 Existing command authorization path
+
+The existing command authorization path is:
+
+```text
+SSH user session
+  |
+  v
+/bin/bash
+  |
+  v
+bash_tacplus plugin
+  |
+  v
+TACACS+ authorization request
+  |
+  v
+TACACS+ server allow/deny response
+```
+
+`bash_tacplus` is the right insertion point because it already builds the TACACS+ command authorization request and calls `tac_add_attrib()` for request attributes.
+
+### 7.2 Selected architecture
+
+This design makes a small, server-side change in the SSH-to-bash path and a small request-construction change in `bash_tacplus`.
+
+| Component | Change |
+| --- | --- |
+| sshd configuration | Accept the client-supplied TraceId environment variable; see [8.1 SSH server configuration](#81-ssh-server-configuration). |
+| SSH client usage | Use stock OpenSSH environment propagation; see [8.2 Client usage](#82-client-usage). |
+| TACPLUS configuration | Enable by default and allow explicit opt-out; see [8.3 Feature configuration](#83-feature-configuration). |
+| bash startup | Apply a best-effort readonly guard; see [8.4 Best-effort bash guard](#84-best-effort-bash-guard). |
+| `bash_tacplus` | Validate the environment value and add the optional `traceid` AV attribute; see [8.6 TraceId validation](#86-traceid-validation) and [8.7 `bash_tacplus` implementation](#87-bash_tacplus-implementation). |
+| TACACS+ server | No protocol change; servers may use or ignore the new AV pair. |
+
+### 7.3 Repositories and modules
+
+The implementation is expected in the SONiC build and TACACS+ code paths.
+
+| Repository area | Expected file or area | Purpose |
+| --- | --- | --- |
+| `sonic-buildimage` host services | `src/sonic-host-services/scripts/hostcfgd` and `data/templates/tacplus_nss.conf.j2` | Render the `traceid_authorization` setting into `/etc/tacplus_nss.conf`. |
+| `sonic-buildimage` YANG model | `src/sonic-yang-models/yang-models/sonic-system-tacacs.yang` | Expose the TACPLUS global `traceid_authorization` configuration field. |
+| `sonic-buildimage` image build | sshd config generation | Add `AcceptEnv SSH_CLIENT_TRACEID` idempotently. |
+| `sonic-buildimage` host config | `files/image_config/bash/bash.bashrc` | Add best-effort `readonly SSH_CLIENT_TRACEID` guard. |
+| TACACS+ bash plugin | `src/tacacs/bash_tacplus/bash_tacplus.c` | Add validation helper and authorization attribute. |
+| TACACS+ bash plugin tests | `src/tacacs/bash_tacplus/unittest/` | Add unit test coverage. |
+
+### 7.4 Architecture non-impact
+
+No changes are required in:
+
+- SWSS
+- syncd
+- SAI
+- orchagent
+- ASIC_DB
+- APP_DB
+- STATE_DB
+- COUNTERS_DB
+- CONFIG_DB
+- platform drivers
+- containers
+
+## 8. High-Level Design
+
+### 8.1 SSH server configuration
+
+SONiC must configure sshd to accept `SSH_CLIENT_TRACEID` from clients:
+
+```text
+AcceptEnv SSH_CLIENT_TRACEID
+```
+
+The implementation must be idempotent. If an active `AcceptEnv` line already exists, the implementation should add `SSH_CLIENT_TRACEID` without removing existing accepted variables. If `SSH_CLIENT_TRACEID` is already accepted, no duplicate entry should be added.
+
+Examples of valid target configuration:
+
+```text
+AcceptEnv SSH_CLIENT_TRACEID
+```
+
+or:
+
+```text
+AcceptEnv LANG LC_* SSH_CLIENT_TRACEID
+```
+
+### 8.2 Client usage
+
+Supported stock OpenSSH client usage:
+
+```bash
+ssh -o SetEnv=SSH_CLIENT_TRACEID=<trace-id> user@sonic
+```
+
+or:
+
+```bash
+SSH_CLIENT_TRACEID=<trace-id> ssh -o SendEnv=SSH_CLIENT_TRACEID user@sonic
+```
+
+### 8.3 Feature configuration
+
+The feature is enabled by default. No TACPLUS configuration field is required for SONiC to include a valid `SSH_CLIENT_TRACEID` value in TACACS+ command authorization requests.
+
+Operators can explicitly disable the feature with the TACPLUS global configuration field:
+
+```json
+"TACPLUS": {
+  "global": {
+    "traceid_authorization": false
+  }
+}
+```
+
+The default is `true`. When the field is absent or set to `true`, `hostcfgd` enables TraceId authorization metadata in `/etc/tacplus_nss.conf`. To opt out, set the field to `false`; SONiC accepts normal SSH sessions and command authorization continues unchanged, but `bash_tacplus` does not add the `traceid` AV pair even if the SSH environment contains `SSH_CLIENT_TRACEID`.
+
+`hostcfgd` renders the enabled state into `/etc/tacplus_nss.conf` as:
+
+```text
+traceid_authorization
+```
+
+`bash_tacplus` reads `/etc/tacplus_nss.conf` through the existing TACACS+ parser and sends `traceid` only when this flag is present. Operators and automation can determine whether the feature is supported by checking for the `traceid_authorization` leaf in the TACPLUS YANG/ConfigDB schema. On a running switch, the feature is enabled when `TACPLUS|global traceid_authorization` is absent or `true`, and disabled only when it is explicitly `false`; the rendered `traceid_authorization` token in `/etc/tacplus_nss.conf` shows the effective enabled state consumed by `bash_tacplus`.
+
+### 8.4 Best-effort bash guard
+
+The system bash startup file should mark `SSH_CLIENT_TRACEID` readonly when it is present:
+
+```bash
+if [ -n "${SSH_CLIENT_TRACEID+x}" ]; then
+  readonly SSH_CLIENT_TRACEID
+fi
+```
+
+Expected behavior:
+
+- Prevent accidental `unset SSH_CLIENT_TRACEID` or `SSH_CLIENT_TRACEID=...` changes in the initial interactive bash shell.
+- Preserve the value for normal interactive command usage.
+- Keep login behavior unchanged when `SSH_CLIENT_TRACEID` is absent.
+
+Known limitations:
+
+- A user can start a child process with a modified environment.
+- The guard only applies to bash startup paths that source the configured file.
+- The guard does not protect non-bash shells or processes that call `execve()` with a custom environment.
+
+### 8.5 traceid attribute semantics
+
+The TACACS+ attribute name is:
+
+```text
+traceid
+```
+
+The authorization AV pair sent to the TACACS+ server is:
+
+```text
+traceid=<trace-id>
+```
+
+The attribute is optional. It is sent only when a valid value is available.
+
+### 8.6 TraceId validation
+
+The selected value format is a generic safe token.
+
+Allowed characters:
+
+```text
+A-Z a-z 0-9 . _ : - |
+```
+
+Validation rules:
+
+| Input | Behavior |
+| --- | --- |
+| Variable unset | Omit `traceid` attribute. |
+| Empty value | Omit `traceid` attribute. |
+| Value length 1 to 247 bytes | Accept if all bytes are allowed characters. |
+| Value length greater than 247 bytes | Omit `traceid` attribute. |
+| Value contains any disallowed byte | Omit `traceid` attribute. |
+
+The 247-byte maximum is derived from a conservative 255-byte TACACS+ AV pair limit:
+
+```text
+255 - strlen("traceid=") = 247
+```
+
+The implementation must reject rather than truncate invalid or oversized values. Truncation would create ambiguous correlation IDs.
+
+### 8.7 `bash_tacplus` implementation
+
+`bash_tacplus` should add a helper that reads and validates the environment variable without mutating it.
+
+Suggested constants:
+
+```c
+#define TACACS_ATTR_MAX_SIZE    255
+#define TRACE_ID_ENV_VARIABLE   "SSH_CLIENT_TRACEID"
+#define TRACE_ID_ATTR_NAME      "traceid"
+#define TRACE_ID_VALUE_SIZE     248
+```
+
+Suggested helper contract:
+
+```c
+bool get_trace_id(char *dst, size_t dst_size);
+```
+
+Helper behavior:
+
+- Read `getenv("SSH_CLIENT_TRACEID")`.
+- Return false when the variable is unset or empty.
+- Validate length before copying.
+- Validate each byte against `[A-Za-z0-9._:|-]`.
+- Copy the exact valid value into the caller-provided buffer.
+- Return false on invalid input.
+- Do not call helpers that tokenize or mutate the string returned by `getenv()`.
+
+The authorization request construction should add the attribute only when validation succeeds:
+
+```c
+char trace_id[TRACE_ID_VALUE_SIZE];
+
+if ((tacacs_ctrl & TRACE_ID_AUTHORIZATION_FLAG) && get_trace_id(trace_id, sizeof(trace_id))) {
+    tac_add_attrib(&attr, TRACE_ID_ATTR_NAME, trace_id);
+}
+```
+
+Recommended placement in the TACACS+ authorization request:
+
+1. Existing session attributes such as `task_id`, `protocol`, and `service`.
+2. New optional `traceid`.
+3. Existing command attributes such as `cmd` and `cmd-arg`.
+
+This keeps `traceid` grouped with session metadata and avoids changing command argument handling.
+
+### 8.8 Failure handling
+
+| Condition | Behavior |
+| --- | --- |
+| `traceid_authorization` disabled | Continue command authorization without `traceid`. |
+| No `SSH_CLIENT_TRACEID` supplied | Continue command authorization without `traceid`. |
+| Invalid `SSH_CLIENT_TRACEID` supplied | Continue command authorization without `traceid`; optionally log debug reason without raw value. |
+| Oversized `SSH_CLIENT_TRACEID` supplied | Continue command authorization without `traceid`; optionally log debug reason without raw value. |
+| TACACS+ server ignores `traceid` | Existing authorization result handling applies. |
+| TACACS+ server rejects request because of policy | Existing authorization failure handling applies; operators must update server policy if needed. |
+
+The feature must not fail SSH login or command authorization solely because `SSH_CLIENT_TRACEID` is missing or invalid.
+
+### 8.9 Serviceability and debug
+
+Debug logging may indicate why `SSH_CLIENT_TRACEID` was omitted, for example invalid length or invalid character class. Logs must not print raw invalid values.
+
+No new counters are required. Existing TACACS+ logging and server-side visibility are sufficient for the initial HLD.
+
+### 8.10 Build and package impact
+
+No new third-party dependencies are required.
+
+Expected impacted build artifacts:
+
+- base image sshd configuration
+- base image bash startup configuration
+- `bash_tacplus` package
+- `bash_tacplus` unit tests
+
+### 8.11 Docker dependency
+
+No docker-specific changes are required. Existing command authorization coverage and limitations remain unchanged.
+
+### 8.12 Platform impact
+
+The feature is platform independent. Platform vendors do not need SAI, SDK, kernel, or driver changes.
+
+## 9. SAI API
+
+No SAI API changes are required.
+
+This feature is limited to SSH session environment handling, bash startup behavior, and TACACS+ command authorization request construction. It does not interact with ASIC state or SAI objects.
+
+## 10. Configuration and management
+
+### 10.1 Manifest
+
+Not applicable. This is not a SONiC Application Extension.
+
+### 10.2 CLI/YANG model enhancements
+
+Add a TACPLUS global YANG leaf named `traceid_authorization` with default `true`.
+
+```yang
+leaf traceid_authorization {
+    type boolean;
+    default true;
+    description "Enable adding validated SSH TraceId values to TACACS+ command authorization requests.";
+}
+```
+
+No CLI command is required for the initial implementation; operators may configure the field through existing ConfigDB/YANG management paths. The default and opt-out semantics are defined in [8.3 Feature configuration](#83-feature-configuration).
+
+### 10.3 Config DB enhancements
+
+Add an optional `traceid_authorization` boolean field to `TACPLUS|global`.
+
+```json
+{
+  "TACPLUS": {
+    "global": {
+      "traceid_authorization": false
+    }
+  }
+}
+```
+
+No new table is added. Existing TACACS+ and AAA configuration commands remain unchanged unless a future CLI enhancement chooses to expose this field directly. Effective runtime behavior is described in [8.3 Feature configuration](#83-feature-configuration).
+
+### 10.4 REST, gNMI, and SNMP
+
+No REST, gNMI, or SNMP changes are required.
+
+## 11. Warmboot and Fastboot Design Impact
+
+No warmboot or fastboot functional impact is expected.
+
+Reasons:
+
+- No database state is added.
+- No hardware state is added.
+- No new service is added.
+- No warmboot reconciliation is needed.
+- No boot-critical runtime dependency is added.
+
+### 11.1 Warmboot and fastboot performance impact
+
+The sshd configuration change is static image configuration. The `bash_tacplus` change runs only when command authorization is invoked and adds a bounded environment lookup and validation step.
+
+No additional stalls, sleeps, long-running IO operations, CPU-heavy boot processing, or third-party dependency updates are introduced.
+
+Active SSH sessions are not expected to be preserved by this feature across warmboot or fastboot.
+
+## 12. Memory Consumption
+
+Memory impact is negligible.
+
+Per command authorization request:
+
+- one small stack buffer of 248 bytes in `bash_tacplus`;
+- no persistent allocation for missing or invalid `SSH_CLIENT_TRACEID`;
+- one additional TACACS+ attribute allocation through existing libtac handling when `SSH_CLIENT_TRACEID` is valid.
+
+No growing memory consumption is expected when `traceid_authorization` is disabled or when clients do not send `SSH_CLIENT_TRACEID`.
+
+## 13. Restrictions/Limitations
+
+- This design is best-effort only and does not prevent deliberate user tampering with process environments.
+- The initial bash `readonly` guard can be bypassed by starting a child process with a custom environment; see [8.4 Best-effort bash guard](#84-best-effort-bash-guard).
+- `traceid_authorization` is enabled by default and can be disabled explicitly; see [8.3 Feature configuration](#83-feature-configuration).
+- `SSH_CLIENT_TRACEID` is treated as a non-secret correlation identifier. Users must not put credentials, tokens, or other sensitive data in it.
+- The `traceid` AV pair is only added to TACACS+ command authorization requests generated by `bash_tacplus`; see [8.7 `bash_tacplus` implementation](#87-bash_tacplus-implementation).
+- Invalid `SSH_CLIENT_TRACEID` values are omitted rather than rejected at login time; see [8.6 TraceId validation](#86-traceid-validation).
+- TACACS+ server policies may need to be updated if the server rejects unknown attributes.
+
+## 14. Testing Requirements/Design
+
+### 14.1 Unit test cases
+
+Add or update tests under:
+
+```text
+src/tacacs/bash_tacplus/unittest/
+```
+
+Recommended unit test cases:
+
+| Test | Setup | Expected result |
+| --- | --- | --- |
+| Valid SSH_CLIENT_TRACEID with feature enabled | `traceid_authorization` enabled and `SSH_CLIENT_TRACEID=\|trace-123:abc.def.` | `tac_add_attrib()` receives `traceid` with exact value. |
+| Valid SSH_CLIENT_TRACEID with feature disabled | `traceid_authorization` disabled and `SSH_CLIENT_TRACEID=trace-123:abc.def` | No `traceid` attribute. |
+| SSH_CLIENT_TRACEID unset | No environment variable | No `traceid` attribute. |
+| SSH_CLIENT_TRACEID empty | `SSH_CLIENT_TRACEID=` | No `traceid` attribute. |
+| SSH_CLIENT_TRACEID too long | 248 or more bytes | No `traceid` attribute. |
+| SSH_CLIENT_TRACEID with space | `SSH_CLIENT_TRACEID="bad value"` | No `traceid` attribute. |
+| SSH_CLIENT_TRACEID with equals | `SSH_CLIENT_TRACEID=a=b` | No `traceid` attribute. |
+| SSH_CLIENT_TRACEID with newline | `SSH_CLIENT_TRACEID` contains newline | No `traceid` attribute. |
+| Consecutive calls | Change or unset env between calls | No stale value from earlier call. |
+| Existing success path | No `SSH_CLIENT_TRACEID` | Existing authorization success behavior unchanged. |
+| Existing failure path | No `SSH_CLIENT_TRACEID` | Existing authorization failure behavior unchanged. |
+
+Mocking requirements:
+
+- record `tac_add_attrib()` calls;
+- verify `traceid` is present exactly once when valid;
+- verify `traceid` is absent when invalid or missing;
+- reset environment and mock state between tests.
+
+### 14.2 System test cases
+
+Run on a SONiC image with TACACS+ command authorization configured.
+
+| Test | Steps | Expected result |
+| --- | --- | --- |
+| Login without SSH_CLIENT_TRACEID | `ssh user@sonic` and run an authorized command | Command authorization behaves as before; no `traceid` AV pair. |
+| Login with SetEnv | `ssh -o SetEnv=SSH_CLIENT_TRACEID=trace-123 user@sonic` and run a command | TACACS+ authorization request includes `traceid=trace-123`. |
+| Login with SendEnv | `SSH_CLIENT_TRACEID=trace-456 ssh -o SendEnv=SSH_CLIENT_TRACEID user@sonic` and run a command | TACACS+ authorization request includes `traceid=trace-456`. |
+| Feature disabled | Set `TACPLUS\|global traceid_authorization=false`, send a valid `SSH_CLIENT_TRACEID`, and run a command | Login and command authorization continue; `traceid` is omitted. |
+| Invalid value | Send `SSH_CLIENT_TRACEID` with a space or equals sign | Login and command authorization continue; `traceid` is omitted. |
+| Bash readonly guard | Attempt `unset SSH_CLIENT_TRACEID` in the initial shell | Bash rejects the unset operation. |
+| Best-effort limitation | Run `env SSH_CLIENT_TRACEID=other bash` | Child shell can alter the value; limitation is documented. |
+
+### 14.3 Regression test cases
+
+- SSH clients that do not send environment variables continue to log in.
+- Existing TACACS+ command authorization policies continue to allow and deny commands as before.
+- Existing remote address, tty, username, command, and argument attributes remain unchanged.
+- Local shell sessions without `SSH_CLIENT_TRACEID` are unaffected.
+- Existing image build is deterministic and does not duplicate `AcceptEnv SSH_CLIENT_TRACEID`.
+
+## 15. Open/Action items
+
+No open design items.
+
+Implementation must confirm the exact source-file locations in the target SONiC branch and validate behavior with the TACACS+ server policy used for deployment.
+
+## 16. References
+
+- [RFC 8907 - The Terminal Access Controller Access-Control System Plus (TACACS+) Protocol](https://www.rfc-editor.org/rfc/rfc8907)
+- [SONiC HLD template](https://github.com/sonic-net/SONiC/blob/master/doc/guidelines/hld_template.md)
+- [TACACS+ Design](./TACACS+%20Design.md)