> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Privileged access management

> Learn how Infisical PAM controls access to your infrastructure.

## What is privileged access management?

*Privileged access management* (PAM) controls who can connect to sensitive infrastructure, such as production databases and servers, and records what they do there.

Without PAM, everyone who needs a database or server gets its password or key. Each copy of the credential can leak, and when someone leaves, you have to rotate the credential and update everyone who still needs it. With Infisical PAM, people and AI agents connect through Infisical, which supplies the credential on their behalf, so the credential never reaches them.

## Accounts

An [account](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md) is a privileged identity on one database, server, cluster, or cloud provider, such as the `app_readonly` user on your orders database. The account stores the connection details and the credential that Infisical uses to connect.

## Folders

A [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) holds accounts. Put accounts in the same folder if the same people need them, because you grant access on the folder and the access applies to every account in it.

You can organize folders by team (`backend-team`), application (`checkout-service`), or environment (`prod`), depending on how access works in your organization.

## Account templates

An [account template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md) sets the rules for connecting to the accounts that use it, such as the maximum session length, whether a reason or MFA is required, and whether access needs [approval](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md). Every account uses a template of the same account type.

Folders and templates are independent:

* Accounts in the same folder can use different templates, so the same team gets different rules for staging and production
* Accounts in different folders can use the same template, so different teams get the same rules

## Memberships

A membership gives a user, group, or [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities.md) a role on a folder or an account. A role on a folder applies to every account in the folder. To grant access to one account only, add the membership on the account instead.

Before anyone can hold a membership, they must be a member of PAM itself. To learn about both levels and the roles each one offers, see [Access control](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md).

## Sessions

A session starts when a person or [AI agent](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview.md) connects to an account, and ends when they disconnect. Before the session starts, Infisical checks the person's role and the template's rules. The connection then runs through a [gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md), which adds the account's credential, and Infisical records everything the person runs.

To learn about each stage of a session, see [Session lifecycle](https://infisical.com/docs/documentation/platform/pam/concepts/session-lifecycle.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.