Why architecture matters here
The architecture matters because standing privileged access is the single largest contributor to breach severity, and it is almost entirely avoidable. Security post-mortems repeat the same story: an attacker gains a foothold through phishing or a vulnerable service, then discovers long-lived admin credentials — an unrotated database password in a config file, a broad cloud role attached to a compromised instance, an SSH key that opens every host — and escalates from a toehold to total control. The credentials did not need to be there. If privileged access is granted just in time and expires quickly, the same foothold finds nothing to escalate with, because at the moment of compromise almost nobody holds privileged access at all. PAM converts a persistent, always-exploitable attack surface into a transient one that exists only during approved, monitored work.
The second forcing function is accountability. When ten engineers share a root account, a malicious or mistaken action is unattributable — you cannot tell who ran the destructive command. PAM makes every privileged action trace to a specific human identity, a specific approved request with a stated reason, and a recorded session, so both accidents and abuse are investigable after the fact and deterred before it. This attribution is not just good hygiene; it is a hard requirement of most compliance regimes, which demand that privileged access be granted on least-privilege, time-limited, approved, and logged terms — precisely the properties PAM is built to provide.
The third reason the architecture matters is that it must deliver all this without becoming an obstacle that engineers route around. If requesting access takes an hour and an incident is on fire, people will create back-door standing credentials 'just in case', and the whole model collapses. So PAM has to make the fast path — request, auto-approve low-risk access, connect — genuinely fast, reserve human approval for high-risk targets, and provide an audited break-glass path for emergencies. The design succeeds only if the secure way is also the convenient way; otherwise the standing access it was meant to eliminate reappears in the shadows, and the organization ends up with the audit theater of PAM but none of its protection.
A fourth reason the architecture earns its complexity is that privileged access is no longer only human. Service accounts, CI/CD pipelines, and automated agents increasingly hold the most powerful credentials in the estate, and they hold them continuously because a pipeline cannot pause for human approval at 2am. This machine identity is where standing access quietly re-accumulates even in organizations that have tamed their human admins. A modern PAM design extends the same principles to non-human principals: short-lived, workload-scoped credentials minted just in time for a job and expired when it finishes, identity derived from the workload's attested context rather than a long-lived secret in an environment variable, and the same brokering and audit applied so that a compromised pipeline cannot become a permanent foothold. Treating machine privilege as an afterthought is how teams end up with pristine human-access hygiene and a service account that can read every database forever.
The architecture: every piece explained
Top row: request and grant. The requester is any principal that needs privileged access — an engineer, an automated job, or a third-party vendor. The access request is explicit and scoped: it names the role or permission, the specific target system, a business reason, and a duration, so access is least-privilege and time-boxed from the outset rather than broad and indefinite. The approval workflow evaluates the request against policy — some low-risk access auto-approves, high-risk targets require human sign-off, and separation-of-duties rules prevent self-approval — producing an auditable decision. On approval, the credential broker mints a short-lived credential (a temporary token, an ephemeral certificate, a just-in-time database user) scoped to exactly the granted access and set to expire with the window.
Middle row: the brokered path to the target. The vault / secret store holds privileged secrets encrypted and rotated, so no long-lived plaintext credential sits in a config file or a wiki; the broker draws from or dynamically generates against it. The session proxy / bastion is the choke point through which privileged connections flow: rather than handing the raw credential to the user, the proxy brokers the connection so the actual secret can stay hidden from the human and every action passes through a controllable, observable point. The target systems — production databases, hosts, the cloud console — are reached only through this path. Session recording captures what happens: keystrokes, commands, queries, or a full session replay, creating a durable record of every privileged action.
Bottom rows: expiry and oversight. Auto-expiry and revocation are what make the access transient: the short-lived credential simply stops working at its TTL, no cleanup required, and a break-glass path exists for emergencies that grants elevated access fast but flags it loudly for after-the-fact review. Audit and SIEM receive every grant, denial, session, and action, feeding investigations, compliance attestations, and anomaly detection. The ops strip names the metrics that measure whether PAM is actually working: the count of accounts with standing privileged access (the number you drive toward zero), how much access flows through the just-in-time path versus back doors, approval latency (the friction that predicts workarounds), and anomaly alerts on unusual privileged activity.
End-to-end flow
Trace a production incident through a mature PAM system. At 2am, an on-call engineer is paged for a database problem. Under the old model she would already hold a standing admin password; under PAM she holds nothing privileged. She opens the access portal and requests the specific role — read/write on the affected database — for two hours, with the incident ticket as the reason. Because this is a break-fix scenario matching policy for on-call engineers, the workflow auto-approves within seconds, and the decision is logged with her identity, the target, the reason, and the expiry.
The credential broker mints a just-in-time database user scoped to that one database with the requested permissions and a two-hour TTL, drawing the connection details from the vault. The engineer connects not by receiving a raw password but through the session proxy, which brokers the connection to the database while keeping the actual credential hidden from her terminal. Every query she runs flows through the proxy and is recorded. She diagnoses the issue, applies the fix, and confirms recovery — all within a monitored session tied to her identity and her approved request.
Two hours later the credential expires automatically. The just-in-time database user is gone; there is no leftover password to rotate, no standing access to revoke, nothing an attacker who later compromised her laptop could reuse. If she needs more time she requests an extension, which is itself logged. The blast radius of the whole episode is bounded to exactly what she was granted, for exactly the window she held it, with a complete record of what she did.
Now the abuse and emergency cases the architecture must also handle. Suppose an attacker phishes a different engineer's SSO session and tries to request broad production access; the approval workflow routes that high-risk request to human sign-off, the reviewer sees a request that does not match any incident or task and denies it, and the attempt is logged and alerted rather than silently granted. Separately, a genuine emergency arises where the normal approver is unreachable and a system is down; the engineer invokes break-glass, which grants elevated access immediately to preserve the ability to respond — but the action fires a high-priority alert, records the session in full, and mandates a post-incident review, so the emergency path is fast without becoming an unwatched back door. Across all these cases the invariant holds: privileged access is requested, bounded, brokered, and recorded, and the count of credentials sitting around waiting to be stolen trends toward zero.