Skip to main content
Access to Infisical PAM has two levels:
  • Product membership makes someone a member of PAM and decides whether they can manage PAM itself
  • Folder and account memberships decide what someone can do with the accounts in a folder, such as connect to them
Users, groups, and machine identities need both. An AI agent has no access of its own and uses the access of the user or machine identity that starts it.

​
Product membership

A product membership gives a user, group, or machine identity one of two roles in PAM: A product admin can’t connect to an account unless they also have a role on the account or its folder.

​
Add product members

1
Go to Privileged Access Management > Access Control.
2
Select the tab for the kind of member you’re adding, then select the button on that tab:
  • Members: Invite Member
  • Groups: Add Group
  • Identities: Add Identity
3
Select the users, group, or identity, choose Admin or Member, and confirm.
On the Identities tab, you can also create a new machine identity for PAM. To learn how an AI agent uses one, see Run agents unattended.

​
Organization admins

When your organization first opens PAM, everyone with the organization Admin role at that moment becomes a product admin. If you get the organization Admin role later, you aren’t a member of PAM yet. Open Privileged Access Management and select Join as Admin to add yourself as a product admin. You can also join any folder as its Admin.

​
Folder and account memberships

A folder or account membership gives a product member one of the following roles on a folder or an account: Infisical records a session for every connection, but not what someone does with a credential they’ve viewed. Give the Operator role only to people who need the credential itself.

​
Folder or account

A role on a folder applies to every account in the folder, including accounts added later. Grant access on folders whenever you can. A role on an account applies to that account only. Use it when someone needs one account in a folder but not the others, such as a contractor who needs one database.

​
Assign a role

1
Go to Privileged Access Management > Accounts.
2
Open the options menu on the folder’s or account’s row and select Configure, then select the Permissions tab.
3
Select Assign Access.
4
Choose the Assignee and the Role. To remove the access automatically after a set time, choose an Expiry.
5
Select Assign.
The Assignee list only includes product members. To give a role to someone who isn’t in the list, add them to PAM first. If you assign a role to a group, the role follows the group’s membership. When someone joins or leaves the group, including through a sync from an identity provider such as Okta or Microsoft Entra ID, their access changes with it.

​
What machine identities can’t do

Machine identities can hold any role, but the following stay with users and groups:
  • Connecting in the browser: Machine identities connect through the CLI
  • Approving access requests: A machine identity can request access, but only users and groups can approve requests
  • Accounts that require MFA: A machine identity can’t complete an MFA challenge, so it can’t connect to an account whose template requires MFA

​
Example setup

The following example gives a platform team access to its databases:
  1. A product admin adds the platform team’s lead to PAM as a Member
  2. The product admin creates a platform-team folder and gives the team lead the Admin role on it
  3. The team lead adds the team’s accounts to the folder
  4. The team lead gives the rest of the team the Connector role on the folder
The team can then connect to every account in the folder, and the team lead manages the folder’s access without involving the product admin.