Glossary

Bastion — a hardened host or service through which administrative sessions are established, concentrating access into a controllable path. Also called a jump host, though the brokered form differs from the traditional one.

Break-glass account — a local, highly privileged account for use when the normal access path is unavailable. Documented, alerted on, rotated after every use, and tested.

Brokered session — a session established by an intermediary that injects the credential without revealing it, so the administrator never possesses the password.

Credential injection — supplying a stored credential to a target system on the user's behalf, without displaying it.

Dynamic secret — a credential created on request, valid briefly, and expiring automatically. Removes the static value that could be leaked or committed.

Just-in-time access — administrative rights granted for a defined period on request and removed automatically at expiry.

Least privilege — holding only the permissions required for the task. A principle; zero standing privilege is one implementation of it.

Path — a sequence of permissions ending in administrative control. Invisible to a membership review and usually more numerous than the accounts themselves.

Privilege elevation — performing a specific administrative action from a non-administrative account, rather than holding administrative rights.

Service account — a non-human identity used by an application, service or automation. Typically outnumbers human privileged accounts and holds broader rights.

Session recording — capture of activity during a privileged session, as video, as text, or as structured commands. Evidentiary and deterrent, not preventive.

Standing access — permanently held administrative rights. The condition every other control works around.

Tier zero — systems and accounts that control the identity infrastructure itself. Compromise here is total, which is why tier zero credentials must never be used on lower-tier systems.

Vault — a system storing privileged credentials with access control, audit and rotation. Necessary and not sufficient.

Workload identity — a platform-issued identity for a running workload, with no stored secret at all. The end state for machine credentials.

Zero standing privilege — the target state where no account holds administrative rights except during an approved, time-bounded task.

Terms used loosely elsewhere

"PAM" covers at least four distinct capabilities. These notes name the specific one — vaulting, elevation, secrets management, or recording.

"Privileged" is used both for accounts and for people. These notes use it for what an account can do, since a person's privilege is the sum of the paths available to them.

"Coverage" means systems onboarded in most vendor reporting and should mean sessions controlled against sessions occurring. The two differ substantially.

"Monitoring" is used for both security telemetry and employee surveillance. Session recording is both, and these notes say so.

"Rotation" is frequently claimed and not verified. These notes treat a rotation as complete only when the old credential has been confirmed to fail.

Terms deliberately avoided

Several common terms in this field are not used in these notes, for reasons worth stating.

"Zero trust" describes an architectural direction and is used to mean almost anything. These notes name the specific control instead.

"Insider threat" is used to justify recording and misdescribes the dominant threat, which is credential compromise. Using it also damages the cooperation the programme depends on.

"Single pane of glass" describes an aspiration rather than a capability, and organisations pursuing it tend to buy a second console.

"Best practice" conceals whose practice and in what context. These notes say what the trade-off is instead.

"Fully compliant" is not a state anything is in.

How to read these notes

A short orientation for anyone arriving at the collection rather than at one page.

Start with the foundations if the subject is new, particularly the standing access note, which everything else refers back to.

Start with discovery if you are scoping a programme.

Start with the failures note if a deployment has stalled.

Start with the recording section if an auditor has asked about it, and read the monitoring obligations before the technology.

The reference section states the boundaries — what the programme cannot do, where the requirements come from, and what remains uncontrolled.

None of it is legal advice, and the notes say so where it matters.