Core Components

Infisical PAM is built around four core components: accounts, folders, account templates, and memberships. Understanding how they relate helps you set up secure, organized access to your infrastructure.

​

Accounts

An account represents a single database or server you want to manage. You provide the connection details (host, port, database) and credentials (username, password), and Infisical stores them securely. Whoever connects, a person or a machine, goes through Infisical without ever seeing the underlying credentials. Infisical supports databases (PostgreSQL, MySQL, MS SQL, MongoDB, Redis), servers (SSH, Windows), Kubernetes clusters, and cloud accounts (AWS IAM, GCP, Azure). Learn more about Accounts →

​

Folders

Group accounts by who needs access to them. If the same people need the same accounts, put them in one folder. If different people need different accounts, use separate folders. You might organize by team (backend-team), department (engineering), application (checkout-service), or environment — whatever matches how access actually works in your organization. Permissions are set at the folder level, so everyone with access to a folder can reach all accounts inside. Learn more about Folders →

​

Account Templates

Account templates define the policies that apply when someone connects to an account:

• Maximum session duration
• Whether a reason is required
• Whether MFA is required

Templates are specific to an account type. This allows for type-specific policies — for example, command restrictions for SSH or query restrictions for databases in future releases. Every account uses a template of the same type. Infisical provides default templates for each account type with sensible settings, so you can start creating accounts immediately. Create custom templates when you need different rules for different environments or compliance requirements. Templates define rules, folders define access. Accounts in the same folder can use different templates (different rules, same team access), and accounts in different folders can use the same template (same rules, different team access). Learn more about Account Templates →

​

Memberships

Memberships determine who can access what by assigning a user, group, or machine identity a role on a folder or account. Memberships on a folder cascade to all accounts inside. For most cases, this is all you need. For exceptions, you can assign memberships directly on individual accounts. Machine identities hold these same roles, which is how an AI agent reaches an account when it runs unattended. Connector is the usual choice. Learn more about Access Control →

​

Next Steps