Adjust PIM settings on the Dialogporten PostgreSQL groups

[knuhau]

Toil type

Other

Context for the task

Follow-up to #3407. The six groups are in place and we have migrated all Dialogporten database environments onto them, verified end to end. Thanks.

After running it for real, we would like six settings changed. All are policy tweaks on existing groups, no new groups needed.

Target configuration

Group (altinn-dialogporten-...)	Duration	Approval	MFA	Justification
test-postgresql-readonly	standing	No	Yes	No
test-postgresql-readwrite	8h	No	Yes	No
test-postgresql-migrator	8h	No	Yes	No
prod-postgresql-readonly	8h	No	Yes	No
prod-postgresql-readwrite	8h	No	Yes	Yes
prod-postgresql-migrator	8h	No	Yes	Yes

What changes

1. Duration to 8h on all groups (today: prod readonly 4h, prod readwrite 4h, prod migrator 2h).
   Some migrations are run by hand and can exceed 2h, leaving the operator unable to reconnect mid-migration.

2. Remove approval on prod readwrite + migrator (today: required).
   The approver group is small and all members are on the same team, so requests stall when people are away. That is a real risk during incidents, since these are the tiers needed to fix a live problem. Meaningful separation of duties would need approvers outside the requesting team, which is an organisational question rather than something we should solve per team. If such a scheme is established later we are open to revisiting this, but it would have to work under time pressure.

3. Enable MFA on activation for the prod groups (today: None; test groups have it).
   You mentioned MFA was the one thing not working when the groups were created. This is the change we would most like, since prod currently has a weaker activation requirement than test.

4. Justification only on prod readwrite + migrator (today: all groups).
   Useful where data can change; elsewhere it is friction nobody reads.

5. Convert the three standing members of test-postgresql-migrator to eligible.
   Our error in Create Dialogporten DB PIM access groups #3407: we asked for "initial members" and "PIM: Eligible" for that group. Standing membership on a migrator tier defeats the purpose.

6. Low priority, informational: approvers get no e-mail for pending requests; the accounts appear to have no mail or proxyAddresses set in Entra. Not worth prioritising if item 2 lands, but it may point at something broader.

Happy to discuss if the platform team sees any of this differently.