OpenSSH

Initially, only requests necessary to complete the key exchange are allowed by monitor.

Afterwards, only requests for user authentication.

Only the monitor determines if authentication is successful or not.

On successful authentication, slave issues a change of identity request.

Slave exports all state to the parent:
Encryption and authentication keys.
Buffered network data.
Compression state.