Privileged access goes beyond the vault.

Start with what needs protecting.

Privileged access management (PAM) governs authority over sensitive resources and operations. Privileged access is often discussed as a vault implementation. A vault can be an important control, but it does not describe the entire route from an identity to a production database, a cloud control plane or a critical application.

I start with the resource and the action. Who can change production? Which workload can retrieve a secret? Which identity can decrypt data? What emergency path remains available when the normal route fails? Those questions expose the places where standing authority, shared credentials and unowned access can undermine an otherwise capable platform.

Access, credentials, secrets and keys do different jobs.

Privileged account controls can govern credential checkout, rotation and use. Infrastructure-access controls can mediate access to servers, clusters and databases. A secrets manager handles application secrets, while a key management service controls cryptographic keys and the operations permitted against them. These capabilities can overlap, but they are not interchangeable.

The design needs to explain the boundaries between them. A machine may authenticate without a stored password and still have excessive authorisation. A rotated secret may still be retrievable by too many identities. An encrypted database may still be exposed through an overprivileged administrator or decryption role.

Technology selection should follow the access model and operational requirements. Session controls, short-lived credentials, approval and just-in-time access depend on the product, resource and integration; do not assume every capability applies to every route.

Make the access path accountable.

Connect identity assurance, authorisation, resource scope and lifecycle decisions. A trustworthy sign-in does not make every subsequent action appropriate. Zero Trust requires a defensible access decision, informed by the identity, resource and available context—not a blanket assumption that an internal connection is safe.

• Name the human or service owner accountable for privileged authority.
• Scope permissions to the resources and operations needed for the task.
• Define approval, duration and removal requirements where the access model supports them.
• Capture useful evidence of grants and activity, with appropriate handling of sensitive session data.
• Design emergency access, monitoring and recovery together so controls remain operable.

Engineer for the exception as well as the standard route.

A control that cannot survive routine maintenance or an incident will invite workarounds. Test rotation against dependent services, rehearse emergency access and establish who resolves failed approvals or stale access. Include non-human identities in that work; privileged automation does not become lower risk because no person types the command.

Evidence needs a purpose. A large volume of session or identity telemetry is not the same as a useful control. Connect events to the identity, approved task, resource and policy decision so teams can investigate unexpected activity and understand whether the operating model is working.

Use a small set of difficult questions.

Pick one sensitive application or database and trace the whole path. Identify standing access, stored credentials, workload permissions, key operations and recovery dependencies. Then ask whether access can be explained, reviewed and removed without breaking the service.

Gartner's 2026 PAM Critical Capabilities research considers human, machine and AI use cases. Its scope reinforces the need to start with use cases rather than treating one control as a universal solution. The practical result should be a prioritised design and engineering plan, supported by owners and acceptance criteria.

At On Running, the engagement connected Zero Trust, IGA and PAM strategy with engineering, configuration, identity telemetry and risk remediation. That is the connection worth preserving: architecture should change how access is controlled in practice.

Practical questions.