# PAM SIM — overview

> PAM SIM is an independent educational simulator. It is not affiliated with, endorsed by, or derived from any commercial privileged access management product, and it is not a substitute for one. It never connects to a real system, never executes a real command, and never stores a real password. Every account, host, identity and credential named in it is invented. It uses the standard vocabulary of the field because that is the vocabulary a real deployment and a real interview use.

## What it is

A working Privileged Access Management environment you can take apart. You request access to a privileged account, have a second person approve it, open a brokered session, watch a credential rotate, and then read the audit trail you just produced. The point is that the workflows are real: the approval genuinely gates the session, the rotation genuinely changes state, and the audit record genuinely comes from what you did.

There is no sign-in and there are no passwords. A visitor arrives with an administrative session already established, so nothing in the simulator is walled off and nobody is asked who they are before they can look. Identity still exists underneath: role-based access control is enforced by the API as well as by the interface, and switching to a narrower identity from the profile menu changes what the application will *do*, not merely what it shows. An Auditor asking the REST console to retrieve a credential gets a real 403.

## Where PAM sits

PAM is one of three pillars of identity and access management. IGA — Identity Governance and Administration — owns joiners, movers and leavers, provisioning, access reviews and segregation of duties. AM — Access Management — owns authentication for ordinary users: single sign-on, multi-factor, federation, adaptive access. PAM owns privileged credentials: the vault, rotation, session brokering and the recording.

AM decides whether you are who you say you are. PAM decides what you may do once you hold elevated rights, and records it. IGA decides whether you should have had that access in the first place, and asks again every quarter. **PAM SIM simulates the third pillar only.** The identity switcher is a demo convenience, not a federation — there is nothing to authenticate against.

## The spaces, and every route

The platform is split into spaces, switched from the service picker in the header — the same way a real deployment separates Privileged Access from Access and from Audit and Reports.

### Privileged Access

Vault, safes, accounts, credential rotation and session management.

Lands on `/`.

- `/` — **Home** (needs dashboard.view)
- `/accounts` — **Accounts View** (needs accounts.view)
- `/discovery` — **Discovery** — industry term: Account discovery (needs accounts.view)
- `/requests/mine` — **My Requests** (needs requests.create)
- `/requests/incoming` — **Incoming Requests** — industry term: Dual control (needs requests.approve)
- `/safes` — **Safes** (needs safes.view, accounts.view)
- `/applications` — **Application Access** — industry term: AAM / Credential Provider (needs applications.view)
- `/secrets` — **Secrets Manager** — industry term: Conjur / Secrets Manager (needs secrets.view)
- `/sessions` — **Active Sessions** — industry term: PSM
- `/recordings` — **Session Recordings** — industry term: PSM recording
- `/cpm` — **Credential Management** — industry term: CPM (needs accounts.view)
- `/policies` — **Policies** (needs policies.view)
- `/reports` — **Reports** (needs reports.view)
- `/platforms` — **Platform Management** (needs platforms.view)
- `/rest-api` — **REST API** — industry term: PVWA REST API (needs accounts.view)
- `/vault` — **Secure Vault** — industry term: Credential vault (needs safes.view)
- `/users` — **Identities** (needs users.view)
- `/roles` — **Roles & Permissions** (needs users.view)
- `/settings` — **Configuration** (needs users.manage, policies.manage)

### Access

Reach the assets secured in Privileged Access, whether vaulted or provisioned just in time.

Lands on `/portal`.

- `/portal` — **Access Portal** — industry term: PVWA (needs accounts.view)
- `/access/infrastructure` — **Infrastructure** — industry term: SIA (needs accounts.view)

### Audit and Reports

Cross-service record of privileged activity, and the sessions view that spans every access method.

Lands on `/audit`.

- `/audit` — **Audit** (needs audit.view)
- `/platform-sessions` — **Sessions** (needs audit.view, recordings.view)
- `/target-events` — **Target Event Log** — industry term: Windows Security log (needs audit.view)

### Identity Security Intelligence

Behavioural risk scoring over privileged accounts, sessions and identities, and the events it raises.

Lands on `/risk`.

- `/risk` — **Risk Center** (needs dashboard.view)
- `/alerts` — **Security Events** (needs alerts.view)

### Learn

Guided walkthroughs, graded labs, the concept reference and the glossary. PAM SIM's own — no product counterpart.

Lands on `/guides`.

- `/guides` — **Guided walkthroughs** (needs labs.view)
- `/labs` — **Labs** (needs labs.view)
- `/concepts` — **PAM Concepts**
- `/glossary` — **Glossary**

## Services named but not simulated

Listed so a reader can place them, never faked:

- **Identity Administration** — Directory integration, authentication policy and provisioning. PAM SIM models identities and roles inside Privileged Access instead.
- **Connector Management** — Deployment and health of the connectors that reach target networks.
- **Secrets Hub** — Synchronisation of vaulted secrets into cloud-native secret stores.
- **Secure Cloud Access** — Time-bound, role-based access to cloud consoles with zero standing entitlements.

## Roles and permissions

Every identity holds exactly one role, and a role is a set of permissions the API checks on each call. Two designs in this table are deliberate and worth noticing: the PAM Administrator who operates the vault is **not** an approver, because the operator of a system should not authorise its use; and the Auditor can see every session and recording but can never retrieve a credential.

| Role | Permissions | What it is for |
| --- | --- | --- |
| Administrator | 28 | Unrestricted platform access. Used sparingly and itself subject to audit — in production this role would be vaulted and requested, not held permanently. |
| Security Administrator | 19 | Owns security posture: policies, security events, session monitoring and approvals. Can force credential rotation but does not administer safes or platforms. |
| PAM Administrator | 24 | Day-to-day operation of the vault: safes, accounts, platforms and credential rotation. Deliberately not an approver — the operator of the system should not authorise its use. |
| Auditor | 14 | Read-only oversight. Sees every audit event, session and recording, and can run any report — but can never retrieve a credential or open a session. |
| Approver | 10 | Authorises privileged access requests on behalf of the business. Can raise and use requests of their own, but sees no administrative configuration. |
| Help Desk | 8 | First-line support. May retrieve credentials for the safes they belong to and open sessions, but cannot change any configuration or approve requests. |
| Standard User | 5 | An ordinary engineer. Can search the account inventory, raise access requests with justification, and use whatever is approved for them. |
| Read Only | 8 | Compliance and reporting visibility with no ability to act. Useful for regulators, risk functions and onboarding. |
| Privileged Access Auditor | 14 | Product-named role. Read-only oversight of the privileged access service: accounts, sessions, recordings, audit and reports. Cannot retrieve a credential. |
| Session Risk Managers | 10 | Product-named role. Reviews privileged sessions and acts on risk: monitor, suspend and terminate live sessions, replay recordings and close security events. |

### The permission vocabulary

The 28 permissions the API recognises: `dashboard.view`, `accounts.view`, `accounts.manage`, `credentials.retrieve`, `credentials.rotate`, `requests.create`, `requests.approve`, `sessions.own`, `sessions.monitor`, `sessions.terminate`, `recordings.view`, `safes.view`, `safes.manage`, `platforms.view`, `platforms.manage`, `policies.view`, `policies.manage`, `users.view`, `users.manage`, `audit.view`, `alerts.view`, `alerts.manage`, `reports.view`, `applications.view`, `applications.manage`, `secrets.view`, `secrets.manage`, `labs.view`.

## Recent changes

- **2026-08-21 · Platform — Spaces and services.** Navigation is now organised into spaces — Privileged Access, Access, Audit and Reports, Identity Security Intelligence — switched from the service picker rather than stacked in one sidebar.
- **2026-08-21 · Accounts — Favorites, saved views and password versions.** The accounts view opens on Favorites, searches can be saved as named views, and each account now has a Versions tab showing every value the CPM has set — including the temporary ones a reconcile leaves behind.
- **2026-08-21 · Monitoring — Monitor a live session.** A fourth action alongside suspend, resume and terminate: open a copy of a running session to watch it, or take co-control. The session owner is notified either way.
- **2026-08-21 · Access — Request Timeframe and multiple access.** Requests now carry an explicit from/to window and a 'multiple access is required' option, and a reason is mandatory on the approver's side of every decision.
- **2026-08-20 · Labs — Eight graded hands-on labs.** Labs are verified against real application state — the audit trail, rotation jobs and safes you actually produce — rather than a checkbox.

## The rest of the corpus

Every other document is listed at https://pamsim.com/llms.txt.