Shared SSH keys
A key remains usable across people and resources after the original task, owner, or approval has changed.
PRIVILEGED ACCESS
Issue privileged authority just in time without handing out long-lived credentials.
Oten Privileged Access combines device trust, approval, JIT entitlement, short-lived credentials or certificates, and session audit for SSH, databases, Kubernetes, and privileged workflows.
System role: Oten Gateway PAM + Oten Endpoint PAM Agent + Control Plane
Evaluation depends on: Requires Verified Access, resource roles, approval, credential lifecycle, and protocol-specific enforcement.
REQUESTResource · Role · ReasonScoped
GATESDevice trust + ApprovalSeparated duties
AUTHORITYShort-lived credentialTime-bound
SESSIONAudit + ExpiryMode-specific
Standing privilege creates risk before a session begins.
Approval lives only in chat
The decision is not durably linked to the resource, role, device, credential, session, or expiry.
Production access from a risky laptop
A valid administrator role can still be used from a device that fails the production resource's mandatory policy.
Session recording without governance
Recording can capture sensitive data without clear notice, masking, retention, playback authorization, or export audit.
Standing privilege becomes bounded, auditable authority.
Request
The user selects a resource and role, then provides a structured business reason.
Evaluate
Policy checks identity, role, device trust, risk, time, and approval requirements.
Approve
An authorized approver grants a constrained window; self-approval is blocked except under an explicit disaster policy.
Issue
Gateway brokers a short-lived credential or certificate and avoids exposing a standing secret where the protocol allows.
Connect
The session is scoped to the approved resource, role, protocol, and time window.
Expire or revoke
Entitlement ends at TTL, policy revoke, or supported active-session termination, with an enforcement result recorded.
The security model spans entitlement, credential, and session control.
JIT request and approval
Structured scope, reason, duration, approver separation, and expiry.
Ephemeral credentials
Short-lived certificate or brokered credential bound to resource and role.
Vault and brokering
Long-lived secrets remain behind a controlled service when protocol and deployment support it.
Session governance
Metadata, recording, playback authorization, and protocol-specific termination behavior.
Device Trust gate
A correct user role does not override a device that fails the resource's trust requirements.
High-risk controls
Dual authorization, command policy, or additional assurance may be required for sensitive actions.
Each privileged protocol has its own authority and session contract.
SSH
Define certificate or credential issue, principal and host scope, agent behavior, renewal, expiry, server enforcement, session evidence, revoke, and connection termination.
Databases
Define database identity, role, credential injection, connection pooling, transaction behavior, session expiry, query evidence, revoke, and administrative ownership.
Kubernetes
Define cluster identity, role or binding, token or certificate lifetime, namespace and verb scope, exec or port-forward behavior, revoke, and audit correlation.
RDP and web administration
Define upstream credential handling, desktop or browser session boundary, recording and masking, disconnect, idle and absolute lifetime, and recovery.
Emergency access is a controlled exception, not an audit bypass.
- Use dedicated emergency identities and roles rather than ordinary personal accounts.
- Require strong MFA or step-up authentication and the smallest possible scope and duration.
- Capture a mandatory reason and ticket reference, then generate immediate high-severity audit and notification.
- Prevent self-approval where possible; require post-event review when disaster mode permits it.
- Rotate credentials and terminate supported sessions after use.
- Exercise the workflow regularly so it remains usable during an actual incident.
Session evidence has its own privacy boundary.
- Disclose recording scope before the session begins.
- Mask or exclude secret input when the protocol supports it.
- Separate recording retention and playback permission from general administration.
- Audit every view, export, or share action involving recorded sessions.
FAQ
Questions security and platform teams ask first.
Does short-lived access always mean passwordless access?
No. Oten should use that term only for protocols and flows that do not expose or rely on a password. A brokered upstream password is still a password even if the user never sees it.
Does Device Trust replace authorization or approval?
No. Device Trust is an additional policy gate. Identity, role, resource scope, approval, and session constraints remain independently required.
Will every privileged session be recorded?
Recording depends on protocol support, privacy policy, retention, deployment, and session mode. Support must be defined by protocol and enforcement mode rather than stated as a universal claim.
Next in Oten Access
Continue the technical evaluation.
Move from standing privilege toward bounded authority.
Review the Gateway enforcement model and the security dependencies required for privileged workflows.