Tanflow PAM · Capability
Roles & Access Control
Run the platform itself under least privilege, with cumulative tiers from User to Super Admin and the most sensitive powers reserved and audited.
Overview
Least privilege for administrators too
Whoever administers a PAM platform holds a great deal of power, so that power needs controls of its own. Tanflow sets up administration as cumulative role tiers and delegated roles, defines what each can do with each resource, and keeps the most sensitive action, revealing a vaulted credential, for the top tier only.
Cumulative levels from User up to Admin and Super Admin, each with everything the tier below has plus more.
Only Super Admin can reveal a stored vault credential, after an MFA step-up, and every reveal is audited.
Roles such as Connection Manager, Identity Manager and Policy Manager hand over one area of administration without full rights.
Manage individual users and put them into groups for easier assignment.
Roles set exactly what a member can do with connections, identities, policies and audit data.
Why it matters
What you can show an auditor
- No single all-powerful administrator by default
- Assignment works through groups instead of one user at a time
- A clear separation of duties that auditors can check
Part of Tanflow PAM
This is built into Tanflow PAM, the privileged access platform that needs no agents and deploys on your infrastructure in 2-4 weeks.
Explore the full platform →FAQ
Common questions
Can we delegate administration without granting full admin?
Yes. Delegated roles such as Connection Manager, Identity Manager and Policy Manager each look after one area of the platform without full administrative rights.
Who can reveal a stored credential from the vault?
Only the Super Admin tier, and only after MFA step-up verification. Every reveal is recorded in the audit trail.
See Roles & Access Control in action
A short demo built around your environment and your compliance requirements.