# What is Privileged Access Management (PAM)?

> Privileged access management (PAM) is the set of policies, processes, and technologies used to control, monitor, and reduce access that can make high-impact changes to systems or data.

- Canonical URL: https://yellowcube.eu/glossary/privileged-access-management/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It applies not only to administrator accounts, but also to service accounts, application secrets, automation, emergency access, and other identities with elevated capability.

PAM aims to replace permanent, poorly attributable privilege with controlled access for a specific identity, purpose, and time. Depending on the environment, it may include credential vaulting, approval workflows, just-in-time elevation, session brokering or recording, command restrictions, and secret rotation.

The practical sequence matters more than the product list: first discover every privileged account and secret — standing admin rights, hardcoded credentials, forgotten service accounts — then vault or federate them, then add elevation workflows and session controls. Vaulting alone changes little if the same standing privileges and shared accounts remain in daily use underneath it.

### Key points

- **Primary purpose:** Reduce the likelihood and impact of misuse or compromise of powerful access.
- **Good design:** Named identities, least privilege, short-lived elevation, strong authentication, separated duties, and monitored emergency procedures.
- **Machine access matters:** Secrets used by software and automation can be as powerful as human administrator credentials.
- **Important limitation:** A password vault alone is not a complete PAM program, and PAM does not make a compromised privileged session harmless.

### Related terms

[Identity and access management (IAM)](<https://yellowcube.eu/glossary/identity-and-access-management/>) · [Least privilege](<https://yellowcube.eu/glossary/least-privilege/>) · [Just-in-time access (JIT access)](<https://yellowcube.eu/glossary/just-in-time-access/>) · [Multi-factor authentication (MFA)](<https://yellowcube.eu/glossary/multi-factor-authentication/>) · [Service account](<https://yellowcube.eu/glossary/service-account/>)

### Sources

[NIST SP 800-53 Rev. 5, controls AC-2 and AC-6](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.