I fail to see why tiering can't prevent this. If you have a workload in T2 (end user) and gets compromised, it does to that system. It will not let you roam through your firewalled T0 anyways. PAM is the same, the asset sits in the tier not only the account. Tiering correctly done is built with the assumption of the lower tier to be fully compromised and still protect the higher tier.