Privileged Access Management (PAM) is the security discipline concerned with controlling, auditing, and minimising the use of privileged accounts: root access, domain administrator rights, cloud IAM roles with wide permissions, database superuser credentials, service account tokens, and any other identity that can cause systemic damage if misused. The threat PAM addresses is specific: an attacker who obtains a regular user credential can typically access that user’s data; an attacker who obtains a privileged credential can move laterally, disable security controls, exfiltrate everything, and deploy ransomware. PAM is therefore not a generalisation of identity and access management (IAM) but a specialisation of it — the same concepts of authentication and authorisation, applied with far higher friction to the accounts that most need it.
The operational core of a PAM system rests on four capabilities. Credential vaulting stores privileged passwords, SSH keys, and API tokens in an encrypted, access-controlled vault rather than in scripts, configuration files, or the heads of administrators; the vault issues the credential into a session on behalf of the user so the user never directly handles the raw secret, and rotates it automatically after use so that a recorded or stolen credential is immediately useless. Session management proxies every privileged connection through the PAM platform, enabling real-time monitoring, full session recording with timestamped keystroke logging, and live termination if a session behaves anomalously — creating an immutable forensic record of every privileged action taken. Just-in-time (JIT) access eliminates standing privileges: rather than an administrator having permanent root or admin rights, they request elevated access for a defined task window, the request triggers an approval workflow (or auto-approves based on policy), the elevated rights are provisioned for the duration, and they are automatically revoked when the window closes. This zero-standing-privilege model means a stolen credential for a privileged account has no inherent value outside an active, approved session. Privilege elevation and delegation extends this to individual commands on a host: rather than giving a user root access, a PAM agent on the target system allows only specific commands to run elevated, enforcing least privilege at the command level rather than the account level.
PAM is distinct from, but deeply connected to, the other entries in this glossary. A bastion host is the traditional network-level implementation of a single, monitored ingress point for privileged access — PAM is the software layer that adds policy, vaulting, and recording to that model, and in modern deployments replaces the bastion with a PAM-brokered session that requires no network-level intermediary at all. Vault (HashiCorp) is a secrets management tool that a PAM system might consume to store credentials, but Vault does not itself record sessions, enforce JIT workflows, or provide the approval and governance model that PAM platforms do — the two are complementary. In a confidential computing context, Trustee plays a role analogous to PAM for machine identities inside TEEs: it gates secret release on attestation evidence rather than human approval, and represents the same zero-standing-privilege principle applied to automated workloads. A break-glass user is the access pattern that PAM explicitly must account for: the pre-defined emergency escape hatch that bypasses normal PAM controls when they are unavailable, and whose use must itself trigger the highest tier of alerting and post-incident review.