Privileged Access Management (PAM) — codename TigerAccess — is TigerTrust’s session-brokering engine. It replaces long-lived SSH keys, static database credentials, and shared bastion hosts with short-lived, per-session credentials and a full recording of every action.

​
What PAM does

  • Brokers SSH, Kubernetes exec, database (Postgres/MySQL/Mongo), RDP, and HTTP application sessions.
  • Mints short-lived certificates for every session — no long-lived keys stored on workstations or resources.
  • Records keystrokes and streams events for playback; supports live joins for moderation.
  • Enforces access requests with approval workflows and time-boxed elevation.
  • Assigns identity to machines via tbot — no more .env files with static secrets.

​
Architecture

   USER                              PAM SERVER                       RESOURCE
   ┌────┐   1. mTLS + short-lived  ┌───────────────┐  4. brokered   ┌──────────┐
   │tash│──── credential ────────►│ tigeraccess-  │──── channel ──►│ SSH host │
   └────┘                          │ server         │                │ K8s API  │
                                   │                │                │ DB       │
   ┌────┐   2. resources + roles  │  audit +       │                │ RDP host │
   │ UI │◄─── from backend ──────│  recording     │                │ HTTP app │
   └────┘                          └───────────────┘                └──────────┘
                                          │
                                   3. persistence to
                                      TigerTrust backend
                                      (Postgres + S3 for
                                       session recordings)

​
The four PAM binaries

BinaryWho runs itWhat it does
tigeraccess-serverYou, on a hardened hostBrokers channels, records sessions, mediates joins
tash-adminOperators (pam_admin)Manage resources, roles, join tokens, live sessions
tashEnd users (SREs, developers)tash ssh, tash kube, tash db, tash rdp
tbotMachines / workloadsFetch short-lived credentials for CI, batch jobs, pods

Install PAM

Server, admin CLI, user CLI, and the machine-identity bot.

​
Core concepts

Resources

Every SSH host, K8s cluster, DB, RDP host, and HTTP app that PAM can broker to. Enrolled via join tokens.

Roles & bindings

Label-based access control. A role grants access to resources by label, plus session policies (recording, join, approval).

Sessions

Every brokered channel. Recorded, live-joinable, and searchable in the audit stream.

Access requests

Just-in-time elevation. Users request a role for a window; approvers grant it.

​
How PAM interacts with other modules

  • CLM issues the mTLS certificates PAM uses between components and for short-lived host certs.
  • Secrets Manager provides the transit engine PAM uses to encrypt session recordings before they hit S3.
  • NHIG treats every PAM role and access binding as an identity relationship in the ownership graph.

​
Where to start

Install PAM

Deploy the server, then install tash on developer workstations.

Enroll your first resource

Turn an SSH host into a PAM resource in under 5 minutes.

Session recording

How recordings are captured, encrypted, stored, and played back.

Kubernetes operator

GitOps for PAM roles, resources, and access lists.