Access Control

Access control in PAM happens at two levels:

1. Product membership — being added to PAM itself (the “entry ticket”)
2. Folder and account memberships — being granted a role on specific folders or accounts (this is what lets you connect)

​

Product Membership

Before anyone can do anything in PAM, they need to be added as a product member. This is the “entry ticket” to PAM. There are two product roles: Product Admins set up the governance layer — they don’t automatically get access to connect to accounts. To connect, you need a membership on a folder or account.

​

Adding Product Members

1. Go to Privileged Access Management → Access Control
2. Select the Users or Groups tab
3. Click Add
4. Select from users or groups that exist in your organization
5. Choose Product Admin or Product Member
6. Click Add

​

Folder and Account Memberships

Once someone is a product member, they still need to be granted access to specific folders or accounts. You do this by assigning them a role on a folder or account.

​

Roles

​

Folder vs Account Memberships

You can assign roles at two levels: Folder memberships apply to all accounts in the folder. This is the primary way to grant access — if someone needs access to a set of accounts, grant them a role on the folder. Account memberships apply to a single account. Use this for exceptions — a contractor who needs just one database, or temporary elevated access to a specific account.

​

How to Assign Memberships

For folders:

1. Open the folder and go to Permissions
2. Click Assign Access
3. Select user/group, role, and optional expiration
4. Click Add

For accounts:

1. Open the account and go to Permissions
2. Same process as above

​

Putting It Together

Here’s a typical setup:

1. Product Admin adds the Platform team lead as a Product Member
2. Product Admin creates a platform-team folder
3. Product Admin grants the team lead Admin on that folder
4. Team lead (now a Folder Admin) adds accounts to the folder
5. Team lead grants the rest of the team Connector on the folder
6. Team members can now connect to any account in the folder

The Product Admin sets up the governance structure. The Folder Admin manages day-to-day access within their scope. Team members connect to what they’ve been granted access to.

​

Next Steps