diff --git a/openbao/ssh/roles-spec.yaml b/openbao/ssh/roles-spec.yaml
index 1ccb34f..0523143 100644
--- a/openbao/ssh/roles-spec.yaml
+++ b/openbao/ssh/roles-spec.yaml
@@ -18,6 +18,8 @@ roles:
     allow_user_certificates: true
     allow_user_key_ids: true
     default_user: agt
+    # CUST-WP-0073 / WARDEN-WP-0045: agt-custodian requests permit-pty explicitly.
+    allowed_extensions: "permit-pty"
     ttl: 24h
     max_ttl: 24h
   atm-role: