# Privileged Access (PAM) Infisical Privileged Access Management replaces standing access to production with time-bound, approved sessions. An engineer or AI agent gets access to a specific database or server for as long as the task needs without seeing the underlying credential, and the whole session is recorded and replayable. In growing organizations, this usually replaces manual workflows where admins have to edit production infrastructure for others or need to share sensitive production credentials in Slack and remember to rotate then. Unlike legacy PAM, there is nothing to install on the target: no agent per host, no jump box to maintain, and no inbound firewall rules, because the gateway connects outbound only. Access happens in the terminal engineers already use. Use this when someone needs an interactive *session* on a resource. When application code needs a credential at runtime, that is [Secrets Management](https://infisical.com/platform/secrets-management.md). ## How you use it A **resource** is the database or server. An **account** is a credential on that resource that Infisical brokers on someone's behalf. Users never hold the account credential; they get a session. | Interface | Use it when | Entry point | |------------------------|----------------------------------------------------------|------------------------------------------| | **CLI** | An engineer wants a session where they already work | `infisical pam access` | | **Browser/Web apps** | Ad-hoc access, or the reviewer approving it | Web UI | | **Agentic CLI** | An AI agent needs to reach your own databases or servers | `infisical pam agentic access -- claude` | | **Approval workflows** | Sensitive accounts need a human in the loop | Slack, Microsoft Teams, ServiceNow | | **Gateway** | The resource is in a private network. Required for those | Outbound-only relay you deploy | ## What you can do with it **End standing production access.** Self-serve access requests with approval gates mean access is granted for a task rather than retained, with just-in-time elevation for sensitive accounts and break-glass policies recorded as such for emergencies. [Access requests](https://infisical.com/docs/documentation/platform/pam/access-requests/overview): request flows, approvals, and duration limits. **Keep the credential from the user.** People connect through the browser or Infisical CLI and never see the real credential. There is nothing to copy into a notes app or leak in a screenshare. Each person gets a dedicated account per resource, so access is individually scoped and revocable without rotating a shared password. [PAM accounts](https://infisical.com/docs/documentation/platform/pam/accounts/overview): every supported account type and how brokering works. **Prove what happened.** Session recording with full playback for every connection, including screen recordings for Windows sessions. Query-level logs for PostgreSQL and command-level logs for SSH. Recordings are stored in Infisical or in an S3 bucket you own. [Sessions](https://infisical.com/docs/documentation/platform/pam/sessions/overview): recording, playback, and retention. **Constrain what can happen in a session.** An account template is the reusable policy attached to an account, and it decides the rest: which commands are blocked, whether MFA re-authentication is required at connection time, whether a reason is mandatory, and what regex-based masking keeps out of the session log. [Templates](https://infisical.com/docs/documentation/platform/pam/templates/overview): per-account policy including command blocking and MFA. **Rotate the privileged credentials themselves.** Automated rotation for PostgreSQL, MySQL, MSSQL, and Windows accounts after the session. The accounts behind brokered access are revoked and replaced after use. [PAM accounts](https://infisical.com/docs/documentation/platform/pam/accounts/overview): which account types support rotation. **Find the accounts nobody documented.** Privileged account discovery scans Active Directory, Linux, and Unix for accounts that exist outside your inventory. [PAM overview](https://infisical.com/docs/documentation/platform/pam/overview): discovery and onboarding. **Reach private infrastructure without inbound rules.** Access runs through a gateway that connects outbound only, with traffic end-to-end encrypted, so no firewall holes are needed to reach a database in a private subnet. [Gateways](https://infisical.com/docs/documentation/platform/gateways/overview): deployment, pools, and network architecture. ## Agentic access PAM brokers access for AI agents the same way Agent Proxy brokers third-party API credentials. One command opens the accounts an agent is allowed to reach, hands it instructions describing them, and starts it inside an OS-level sandbox. CLI example: ```bash infisical pam agentic access -- claude ``` - **No credential reaches the agent.** Each allowed account is opened as a local port and the gateway supplies the real credential on the far side. Ports open first and nothing is connected, so a session only begins when the agent actually reaches for an account, subject to the usual role, duration, and approval checks. - **Narrow the scope with `--account`.** Define exactly what account an agent should use. - **Pass `--reason` if any account's template requires one.** You can require a stated reason why access was needed in policies to understand what was going on and needed fixing. - **Attribution follows the login.** Run as yourself and sessions are attributed to you; give the agent its own machine identity and they belong to it. - **Claude Code, Codex, and Gemini are recognized by name** and told what they can reach in their own format. An agent you wrote yourself reads the same instructions from an environment variable. [PAM for AI agents](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview): full flag reference, sandbox behavior, and unattended runs. [ai-agents.md](https://infisical.com/ai-agents.md): everything Infisical does for AI agents, including when to broker infrastructure access this way versus brokering a third-party API credential with Agent Proxy. ## Getting started [PAM overview](https://infisical.com/docs/documentation/platform/pam/overview): concepts, setup order, and onboarding a first resource. Deploy a [gateway](https://infisical.com/docs/documentation/platform/gateways/overview) first if the resource is in a private network. ## Pricing Billed per **user**. Every plan includes a 14-day trial. Pro covers up to 50 resources with 30-day log and session retention. Enterprise adds unlimited resources, Windows and RDP, privileged account discovery, SCIM, LDAP, SIEM streaming, and custom retention. [pricing.md](https://infisical.com/pricing.md): exact plan contents. ## Where it works Complete list of account types as of this page's last update. The docs are authoritative if something is missing. [PAM accounts](https://infisical.com/docs/documentation/platform/pam/accounts/overview) | Category | Account types | Notes | |---|---|---| | **Databases** | PostgreSQL, MySQL, Microsoft SQL Server, MongoDB, Redis | Query-level session logs on PostgreSQL. Automated credential rotation on PostgreSQL, MySQL, and MSSQL | | **Servers** | SSH, Windows (over RDP), Windows Active Directory joined | Command-level session logs on SSH, and SSH certificate authentication instead of distributed keys. Windows and RDP are Enterprise | | **Clusters** | Kubernetes | Set up automatically in agentic runs, so `kubectl` works without touching your own kubeconfig | | **Cloud identities** | AWS IAM, GCP service accounts, Azure CLI | Time-bound cloud access without long-lived keys on a laptop | **Discovery** covers Active Directory, Linux, and Unix privileged accounts. ## Docs [PAM documentation](https://infisical.com/docs/documentation/platform/pam/overview): full product reference.