PAM session lifecycle

A session starts when a person or AI agent connects to an account, and ends when they disconnect. This page describes each stage, from the checks Infisical runs before the session starts to the records it keeps afterward.

​

Before the session starts

Infisical checks the following before it starts a session:

1. The person has a role on the account or its folder that lets them launch sessions
2. The person gives a reason, if the template requires one
3. The person completes MFA, if the template requires it
4. An approver has approved the person’s access request, if the template requires approval

AI agents go through the same checks. An agent can’t answer a prompt, so you pass the reason with --reason when you start the agent, and the agent can’t use accounts that require MFA. To learn more, see Run an agent.

​

Connecting

The connection runs through a gateway on your network. The gateway connects to the database or server with the account’s credential, so the credential never reaches the person’s browser or machine. For each step of the connection, see Architecture. What the person sees depends on the account type and on whether they connect in the browser or with the CLI. To learn how to connect each way, see Connect to an account.

​

During the session

Infisical records the queries or commands that the person runs. Admins and Auditors on the account can review the recording while the session is still active.

​

Ending the session

The session ends when one of the following happens:

• The person disconnects
• The session reaches the template’s maximum session length
• An Admin on the account terminates the session

​

After the session

Infisical keeps the following records of each session:

• Recording: Admins and Auditors on the account can review it on the Sessions page
• Audit log: The audit log has events for the session, such as Start PAM Session and End PAM Session

​

Next steps