> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/reference/privileged-access-and-privileged-identity.md).

# Privileged access and privileged identity

Privileged Access Management controls and monitors access to the accounts that run your estate — administrator accounts, root accounts, database superusers, network device enable secrets, and application service accounts.

This page explains the problem PAM solves, how SECUREpass approaches it, and how the pieces fit together. The task pages that follow cover connecting target systems, the credential vault, session management and recording, cloud and DevOps, and privileged identity management.

## The privileged access problem

Privileged credentials are the operational primitive on which every IT estate runs, and consistently the asset class most associated with high-impact security incidents.

Three structural patterns make them hard to control:

* **The privileged population grows non-linearly with system count.** Every new server, database and network device adds more than one privileged account.
* **The population is heterogeneous.** Humans, services, scheduled jobs and autonomous workloads all hold privilege, and they behave nothing alike.
* **Credentials persist.** Standing privilege accumulates over time because nothing forces it to lapse.

SECUREpass PAM addresses all three across the full population of privileged identities — human and non-human, on-premises and cloud.

## Where PAM sits in SECUREpass

PAM is a module of the wider SECUREpass converged identity platform, not a separate product. The platform already provides IAM, multi-factor authentication, single sign-on, directory services and identity governance under one administrative console with one audit pipeline. PAM extends it with, session management,command filtering, RADIUS, and the rest of the privileged-access capabilities.

## Key concepts

| Term                 | Meaning                                                                                                            |
| -------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Privileged account   | An account with elevated rights, managed through SECUREpass                                                        |
| Credential vault     | Where privileged secrets are stored; cryptographic protection at rest is delegated to an external HSM or key vault |
| Checkout and checkin | Requesting time-limited use of a credential, then returning it                                                     |
| Credential injection | The gateway supplies the credential to the target so the user never sees it                                        |
| Session recording    | Capture of the privileged session for audit and forensics                                                          |
| Just-in-time access  | Elevating privilege only when needed, for a limited time, then revoking automatically                              |
| Break-glass          | Emergency access without the normal approval path, fully audited                                                   |
| Dual control         | A second person must approve before a session can start                                                            |

## How PAM and PIM relate

The two are complementary layers over the same population.

**PAM controls what an authenticated privileged user can do** — which targets they reach, what happens in the session, which commands are permitted, and what gets recorded.

**PIM controls who the privileged identities are** — what entitlements they hold, how those entitlements are reviewed and certified, and how the identity lifecycle is administered.

PIM shares the directory model, the audit pipeline and the administrative console with PAM. It is covered on its own page.

## Architecture

### Five planes

SECUREpass PAM is organised as five cooperating planes. They are loosely coupled, communicate over mutually authenticated TLS, and scale independently.

| Plane   | Responsibility                                                                                              |
| ------- | ----------------------------------------------------------------------------------------------------------- |
| Access  | Mediates every privileged session and authentication event — authentication, SSO, MFA, RADIUS.              |
| Control | Administers policy, workflow and credential lifecycle — the PAM and IAM admin consoles, the workflow engine |
| Data    | Stores credentials, audit records, session recordings and the directory cache                               |
| Policy  | Evaluates access decisions against role, attribute, geofence and risk signals                               |
| Audit   | Captures and exports an immutable record of every administrative, vault, session, approval and policy event |

The PAM module spans the Access, Control and Data planes. The Policy and Audit planes are shared with the wider platform — which is why a privileged session and an ordinary login land in the same audit trail.

### Components

Each component is independently deployable and independently scalable.

| Component                        | What it does                                                                                                                             |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Credential Vault                 | Stores the privileged secrets PAM mediates                                                                                               |
| Access Gateway / Session Manager | Protocol proxy for SSH, RDP, database, SAP and web admin sessions. Injects credentials and captures recordings                           |
| RADIUS                           | AAA for network device administration, VPN admin authentication, and the MFA challenge channel                                           |
| Discovery Engine                 | Scans the estate for privileged accounts across Active Directory, Linux and UNIX, databases and network devices                          |
| Policy Engine                    | Evaluates each request against RBAC, ABAC, geofence, time-of-day, device-posture and risk-score policies; returns allow, deny or step-up |
| Workflow & Approval Engine       | Orchestrates request → elevation → revocation, with single and multi-level approvals, SLA timers, escalation and ITSM tie-back           |
| Threat Analytics / UEBA          | Behavioural baselining per user and per role, anomaly detection, risk scoring, automated response                                        |
| Audit & Reporting Service        | Captures every event, signs records, exports to SIEM and SOAR via Syslog, CEF, LEEF and REST                                             |
| Admin Console                    | One interface across PAM, IAM, MFA, SSO and governance                                                                                   |
| REST API layer                   | Every console operation, plus secret retrieval for non-human callers. SDKs in Java, Python, Go and .NET                                  |
| Connector framework              | Pluggable target integrations, extensible by customers and partners                                                                      |
| HSM / key vault abstraction      | PKCS#11, KMIP and REST integration with the external HSM or key vault                                                                    |

## Deployment models

Five models, all running the same code base and the same configuration model. What differs is the operational topology and the trust boundary.

| Model             | Where it runs                                                                                                                                                                                             |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| On-premises       | The default. Application tier, database, vault, gateway, AAA server and recording store all inside the customer data centre                                                                               |
| Private cloud     | The same components in a tenant-isolated VPC or VNet on AWS, Azure, GCP or equivalent, using cloud-managed database, object storage and HSM where available                                               |
| Hybrid            | Control plane on-premises; Access Gateway, Discovery Engine and Threat Analytics extended into the cloud for proximity to cloud targets. Audit flows back on-premises                                     |
| SaaS multi-tenant | Shared application tier with per-tenant database isolation. For managed service providers and group conglomerates                                                                                         |
| Air-gapped        | The full stack inside the customer perimeter with no outbound connectivity. No degraded mode — the complete feature set is available. Updates arrive on offline media through a signed verification chain |

{% hint style="info" %}
Air-gapped deployment is intended for defence, intelligence, national security and sovereign-cloud environments, and anywhere data-residency rules treat privileged-credential metadata as in scope.
{% endhint %}

## Who uses it

| Persona                                                                      | How they interact with PAM                                                                                                                 |
| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Privileged user — DBA, sysadmin, network engineer, application administrator | Starts privileged sessions, requests JIT elevation, uses the personal vault. Subject to MFA, command filtering, recording and idle timeout |
| PAM administrator                                                            | Configures policies, workflows, target onboarding, roles and integrations. Subject to step-up MFA on sensitive operations                  |
| Approver or line manager                                                     | Acts on access requests through the workflow engine                                                                                        |
| Security operations analyst                                                  | Monitors audit and threat analytics, investigates anomalies, initiates emergency revocation                                                |
| Security auditor                                                             | Read-only access to the audit trail, recordings, attestation records and compliance reports                                                |
| System or application owner                                                  | Owns specific targets, participates in access reviews, receives notifications on activity against them                                     |
| Developer or DevOps engineer                                                 | Consumes vault credentials via REST API and SDKs, receives short-lived dynamic credentials, integrates with CI/CD and Kubernetes           |
| External vendor or third party                                               | Onboarded with time-bound credentials, biometric or FIDO2 MFA, and engagement-scoped access                                                |
| Application or service account                                               | Authenticates via mTLS, signed JWT or OAuth 2.0 client credentials. Subject to rotation and short-lived credentials                        |
| MSP operator                                                                 | Cross-tenant administration on multi-tenant deployments                                                                                    |

## Default roles

PAM inherits the SECUREpass core RBAC model and adds privileged-access roles. Customer-defined roles can extend or restrict these. Role definitions are version-controlled and audited, and custom roles are checked against the segregation-of-duties ruleset at assignment time.

| Role                    | Scope                                                                                                          |
| ----------------------- | -------------------------------------------------------------------------------------------------------------- |
| PAM Super Administrator | Full platform administration. Subject to dual control on changes affecting cryptographic policy or HSM binding |
| PAM Administrator       | Day-to-day administration: target onboarding, role assignment, policy configuration                            |
| Vault Administrator     | Vault entries, rotation policy, reconciliation oversight                                                       |
| Session Administrator   | Live monitoring, mid-session join, recording review                                                            |
| Approver                | Acts on workflow requests within an assigned approval graph                                                    |
| Privileged User         | Operates targets within assigned entitlements                                                                  |
| Security Auditor        | Read-only: audit trail, recordings, attestation records, compliance reports                                    |
| SOC Analyst             | Read access to threat analytics; can initiate emergency revocation                                             |
| Discovery Operator      | Configures discovery scans and reviews findings                                                                |
| MSP Operator            | Cross-tenant operations on multi-tenant deployments                                                            |

## Where to go next

| Page                             | Covers                                              |
| -------------------------------- | --------------------------------------------------- |
| Connecting target systems        | Onboarding SSH, RDP, database and cloud targets     |
| Privileged account vault         | Vaulting, rotation, checkout, JIT and break-glass   |
| Session management and recording | Recording by target type, live monitoring, playback |
| PAM for cloud and DevOps         | Kubernetes, CI/CD and secrets                       |
| Privileged identity management   | Lifecycle, JEA, JIT identity, SoD and attestation   |

The shape of SECUREpass PAM is a gateway in the path of every privileged connection, a vault the user never reads from directly, and an audit trail that outlives the session — all administered from the same console as the rest of your identity estate.