What is privileged access management?
Privileged access management is the control and recording of elevated access to enterprise systems. It covers which credentials carry elevated rights, together with who may use them under what approval. Automated actors need the same treatment as people, since an agent acting in a system of record holds rights a person once held.
Also called: PAM
Why security asks about the agent before operations does
The question arrives from the security architect rather than from the process owner, usually in the second week. An agent completing work inside a core banking system holds entitlements somebody had to grant, and the architect wants to know which vault issues the credential and how the session is recorded. Projects that cannot answer stop at that meeting. The answer belongs in the design, since retrofitting an agent into a privileged access regime means re-engineering how it authenticates.
- Elevated rights granted to an agent are exercised at machine speed and scale.
- An agent without its own identity inherits a person's, which destroys attribution.
- Session recording is what lets an investigation establish what the agent did.
- Credentials embedded in automation outlive the project that introduced them.
How privileged access management works
- Each automated actor is registered as its own identity with a named owner.
- Entitlements are granted per task rather than as a standing administrative role.
- Credentials are issued from a vault at the moment of use and expire afterwards.
- Every elevated session is recorded so that the actions taken can be replayed.
- Approval for a privileged action is required from a person outside the delivery team.
- Entitlements are reviewed on a schedule against what the automation actually uses.
How privileged access management is evaluated
Privileged access management is tested by asking who could have taken a given action. Examine the following across every automated actor in the estate:
- count of standing privileged credentials held by automation
- proportion of agent sessions with a complete recording
- median lifetime of a credential issued to an agent
- entitlements granted against entitlements exercised last quarter
- time to revoke access for a decommissioned agent
Limitations, risks and common failure modes
- Automation is given an administrative role because scoping the entitlement takes longer.
- One account is shared across several workflows, so attribution disappears.
- Session recording is enabled for people and omitted for automated actors.
- Credentials rotate on a schedule the automation cannot tolerate, causing silent failure.
- Access reviews list human owners who left the organisation months earlier.