Skip to main content
To give an AI agent access to your PAM accounts, start the agent with infisical pam agentic access. The CLI opens the accounts the agent can use, gives the agent instructions for reaching them, and starts the agent in a sandbox. To learn how agentic access works, see AI agents.

​
Prerequisites

​
Start an agent

Everything after -- is the command that starts your agent. By default, the agent can use every account you can launch a session on. To give the agent only the accounts its task needs, add --account once for each account:
Before the agent starts, the CLI prints the accounts the agent can use:
If you don’t pass --account, the CLI lists each account it left out under Not started, with the reason. If you pass --account and a named account can’t be used, the command stops and prints the reason. If an account’s template has Require Reason turned on, pass the reason with --reason. The CLI can’t ask for a reason while the agent is running in the terminal.
For all flags available with the infisical pam agentic access command, check out the CLI reference.

​
Supported account types

Agents can use the following account types: For Kubernetes accounts, the CLI configures kubectl inside the run without changing your own kubeconfig.
Agents can’t use accounts whose template has Require MFA turned on. To use one of those accounts yourself, run infisical pam access, which asks you to complete MFA in your browser.

​
Sandbox

The CLI runs the agent in a sandbox that the operating system enforces. The sandbox stops the agent from reading your Infisical login, so the agent can’t open sessions on accounts beyond the ones the run started with. The operating system applies the sandbox to the agent and to every process the agent starts, and the agent can’t turn the sandbox off from inside it.

​
What the agent can access

The agent can still read common development files such as ~/.aws, ~/.ssh, and ~/.kube, so tasks like git over SSH keep working. The sandbox protects your access to PAM, not every secret on the machine.

​
Limits of the sandbox

The sandbox adds protection, but it doesn’t guarantee that an agent can’t reach your secrets:
  • No operating system sandbox blocks every way to read files on the host, so an agent that is built or tricked into searching for secrets might find a way past it
  • The agent keeps its network access, so the sandbox doesn’t stop the agent from sending data off the machine
Whether or not the sandbox stops an agent, the account credentials never reach the machine. Each connection is a session that you can watch and terminate, and the agent’s access is limited by role, duration, and approval. For a sensitive task, run the agent as its own machine identity on a dedicated machine. The identity’s roles then limit what the agent can reach, even if the agent gets past the sandbox.

​
Turn the sandbox off

To run the agent without the sandbox, pass --no-sandbox:
Without the sandbox, the agent can read your Infisical login and every other credential file on the machine. Keep the sandbox on wherever your operating system supports it.

​
Accounts that need approval

If an account requires approval, the CLI still opens a port for it and marks it [awaiting approval]. The agent can’t use the account until an approver approves a request. The first time the agent connects to the account, the CLI files a request and the connection fails. After an approver approves the request, the agent’s next connection works without restarting the run. If the approved access expires during the run, the same thing happens again: the CLI files a new request, and the account works after an approver approves it. To stop the CLI from filing requests, pass --no-approval-request. The CLI then leaves accounts that need approval out of the run.

​
Frequently asked questions

Check the Not started list that the CLI prints at the start of each run, which gives the reason for each account it left out. If the account isn’t there either, whoever the run authenticated as can’t launch sessions on it, so check their role on the folder or account.
The request is waiting for an approver. If the folder has no approvers on its Approvals tab, nobody can approve the request.
No. Only users and groups can approve requests, whoever the agent runs as.
The sandbox isn’t available, usually because bubblewrap isn’t installed or the host restricts user namespaces. The error message says which. Install bubblewrap or allow user namespaces on the host, then run the command again.

​
Next steps

Review and stop an agent

Check what an AI agent did with your accounts and remove its access.

Run unattended

Run an AI agent as its own machine identity.