A privileged access management platform holds the root passwords, Windows admin accounts, database users and SSH keys for an organisation's most sensitive systems. Whoever administers that platform can, in principle, reach all of them. Tanflow PAM applies least privilege to its own administrators through cumulative role tiers, delegated roles and per-resource permissions, and it keeps the most sensitive action, revealing a vaulted credential, for the top tier.
Why administrators of a PAM platform need limits of their own
Many access tools are run from one administrator account that can do everything: add targets, change policy, read the audit log and look at stored passwords. That account becomes the most attractive target in the environment. If it is phished, or its holder makes a mistake, the controls the platform enforces can be undone from inside.
In Tanflow PAM there is no single all-powerful administrator by default. Power over the platform is divided by tier and by area, so each administrator holds the part their job needs.
Cumulative tiers from User to Super Admin
The administrative tiers run from User through Manager and Admin up to Super Admin. They are cumulative, so each tier has everything the tier below it has, plus more. Moving someone up a tier only adds powers, and the difference between two tiers is the set of powers the higher one adds. That makes a promotion easy to describe and easy to review.
Plenty of people who use the platform every day need very little. An engineer picks a target from their authorised list in the PAM portal, the gateway injects the vaulted credential into the session, and the engineer never sees, copies or types the password.
Delegated roles for one area of administration
Some administration is specialised, and the team that adds servers to the estate is often not the team that writes command policy. Tanflow PAM provides delegated roles for this. Connection Manager, Identity Manager and Policy Manager each look after one area of the platform, as their names suggest, without full administrative rights.
In an illustrative setup, a network engineer holds Connection Manager to add switches and routers as connections, and a security engineer holds Policy Manager to maintain command control rules. Neither of them needs the Admin tier to do that work.
Groups and per-resource permissions
Roles set exactly what a member can do with each kind of resource the platform manages:
- connections, the targets people reach through the gateway
- identities, the people and accounts that use the platform
- policies, such as command control and file-transfer rules
- audit data, the logs and session recordings
Administrators manage individual users and put them into user groups, and assignment works through those groups. A new member of the database team picks up the group's access in one step.
Treating audit data as a resource of its own lets an organisation give auditors what they need and no more. A scoped auditor role can search logs and watch replays, read only, for the period of an engagement, and the auditor's own activity is logged too.
Why vault reveal is reserved for Super Admin
Inside Tanflow PAM, most credentials never reach a person. The vault stores them with AES-256 encryption at rest, rotates them on a schedule or after each use, and injects them into gateway sessions. Where a credential has to be released to someone, check-out gives it to that person exclusively for a set time and rotates it at check-in. Sealed break-glass credentials need several approvers to unlock, and a mandatory review follows.
Revealing a stored credential puts the secret itself in front of an administrator. Tanflow PAM keeps that power for the Super Admin tier alone. Even a Super Admin has to pass an MFA step-up first, which is a fresh second-factor check at the moment of the action, and every reveal is written to the audit trail.
The three conditions cover different risks. Holding reveal at the top tier keeps the number of people who can use it small. The step-up means that a password, or a session someone else has taken over, is not enough on its own. The audit record ties each reveal to a named person and a time.
What an auditor can check
Tiered administrator roles, together with just-in-time elevation and approval windows, are how Tanflow PAM is designed to align with ISO/IEC 27001:2022 control A.8.2 on privileged access rights. Role assignments give an auditor a clear separation of duties to check.
The audit trail is the other half of that check. Tanflow PAM writes logs append-only with integrity checks, and administrative access to the audit store is itself audited. A Super Admin's reveal therefore lands in a log that the Super Admin cannot edit without leaving a trace.