Access Control

Access control in PAM happens at two levels:

1. Product membership — being added to PAM itself (the “entry ticket”)
2. Folder and account memberships — being granted a role on specific folders or accounts (this is what lets you connect)

Users, groups, and machine identities all go through both levels and hold the same roles, so everything below applies to all three unless it says otherwise. An AI agent runs as whoever started it, so it uses either a person’s access or a machine identity’s.

​

Product Membership

Before anyone can do anything in PAM, they need to be added as a product member. This is the “entry ticket” to PAM. There are two product roles: Product Admins set up the governance layer — they don’t automatically get access to connect to accounts. To connect, you need a membership on a folder or account.

​

Adding Product Members

1. Go to Privileged Access Management → Access Control
2. Select the Users, Groups, or Identities tab
3. Click Add
4. Select from users, groups, or machine identities in your organization
5. Choose Product Admin or Product Member
6. Click Add

The Identities tab can also create a new machine identity for PAM instead of adding an existing one. See AI Agents for the agent workflow that uses it.

​

Folder and Account Memberships

Once someone is a product member, they still need to be granted access to specific folders or accounts. You do this by assigning them a role on a folder or account.

​

Roles

​

Folder vs Account Memberships

You can assign roles at two levels: Folder memberships apply to all accounts in the folder. This is the primary way to grant access — if someone needs access to a set of accounts, grant them a role on the folder. Account memberships apply to a single account. Use this for exceptions — a contractor who needs just one database, or temporary elevated access to a specific account.

​

How to Assign Memberships

For folders:

1. Open the folder and go to Permissions
2. Click Assign Access
3. Select a user, group, or machine identity, then set the role and an optional expiration
4. Click Add

For accounts:

1. Open the account and go to Permissions
2. Same process as above

The picker only offers members of PAM, so a machine identity has to be added on the Access Control page before it can be granted a role here.

​

What Only People Can Do

Two things stay with users and groups:

• Web Access. Connecting in the browser is for users. Machine identities connect through the CLI.
• Approving access requests. A machine identity can file a request, but only users and groups can approve one.

An account whose template requires MFA also stays with people: a machine identity can never complete the challenge, and agent runs do not support it yet.

​

Putting It Together

Here’s a typical setup:

1. Product Admin adds the Platform team lead as a Product Member
2. Product Admin creates a platform-team folder
3. Product Admin grants the team lead Admin on that folder
4. Team lead (now a Folder Admin) adds accounts to the folder
5. Team lead grants the rest of the team Connector on the folder
6. Team members can now connect to any account in the folder

The Product Admin sets up the governance structure. The Folder Admin manages day-to-day access within their scope. Team members connect to what they’ve been granted access to.

​

Next Steps