BeyondTrust Password Safe key terms

A server, network device, database, or application that Password Safe controls access to, typically by holding the credentials used to log in to it and applying policy to those accounts.

The hardened, encrypted repository where managed account credentials, SSH keys, and related secrets are stored, protected so that no user or administrator can read them directly without going through an authorized retrieval path.

The dedicated Password Safe server or virtual machine that hosts the vault, web interface, policy engine, and supporting services as a self-contained hardened unit rather than a set of separately administered components.

A deployment arrangement in which multiple Password Safe appliances share vault data and configuration so that service continues if one node fails and load can be distributed across nodes.

A design goal in which redundant Password Safe nodes and supporting infrastructure keep credential access available during hardware failure, maintenance, or site outage, usually achieved through clustering and health monitoring.

The process of capturing encrypted copies of vault contents and configuration on a schedule and validating that they can be recovered, so credential data survives corruption, ransomware, or appliance loss.

A cryptographic value used to protect vault contents at rest and in transit; its custody, rotation, and separation from backups are central to whether stored credentials remain confidential.

A privileged account that Password Safe itself uses to perform automated work on a managed system, such as changing a password, verifying a credential, or running a scripted task.

The act of a user requesting and receiving temporary access to a stored credential, which may be revealed in the interface or injected into a session without disclosure, depending on policy.

Returning a checked-out credential to exclusive vault control, often accompanied by an automatic rotation so that the version the user saw is no longer valid.

Automated replacement of a managed account's password or key on a defined schedule or trigger, followed by verification and propagation to dependent systems so access continues to work.

A test in which Password Safe confirms that the credential stored for an account actually works on the target system, catching drift caused by manual changes or failed propagation.

A relationship in which another system, service, or scheduled task relies on an account's credential, so rotation must update that consumer as well or the dependent service will break.

A periodic automated check that a managed system is reachable and that Password Safe can still perform its configured credential operations against it, surfacing failures before users are affected.

The discipline of storing, distributing, rotating, and auditing non-password secrets such as API keys, certificates, and SSH keys under the same controlled access model as passwords.

Handling of SSH public and private keys so that private keys stay vaulted, are injected only for authorized sessions, and can be rotated or revoked without distributing copies to endpoints.

The set of rules that determines which users or groups may access which managed accounts, under what conditions, and with what approvals, often expressed through assigned roles and time windows.

An access model in which permissions are granted to roles rather than to individuals, and users receive access by being placed in the appropriate role, simplifying administration and review.

The principle that each user, service, and administrator receives only the access needed for their assigned tasks, reducing the blast radius of a compromised account or insider misuse.

A configured process in which a user's request for credential access or a session is routed to one or more approvers who must grant it before access is released, with the decision recorded.

A user's formal ask for access to a specific credential or system, including any justification and requested duration, which then follows the configured approval path.

A request to open a proxied or recorded session to a managed system, which may require approval and may specify the target, duration, and reason before the connection is allowed.

An intermediary through which user connections to managed systems pass, allowing Password Safe to inject credentials, apply policy, and capture activity without revealing the password to the user.

Automatic placement of a vaulted credential into a session by the proxy so the user never sees or types the password, which also prevents the secret from reaching the user's workstation.

Capturing a replayable record of activity within a privileged session, including keystrokes and screen output, so that actions taken with a shared account can be reviewed later.

Live observation of active privileged sessions by an authorized reviewer, who can watch activity as it happens and, where configured, intervene or terminate the connection.

A tamper-evident record of security-relevant events such as logins, checkouts, approvals, rotations, and configuration changes, used for investigation, compliance evidence, and accountability.

A structured output that summarizes vault state or activity, such as which credentials exist, who holds access, and what was checked out, supporting access reviews and compliance obligations.

A periodic examination in which reviewers confirm that each user's and group's access to managed accounts is still justified, and remove entitlements that are no longer needed.

Sending Password Safe event and audit records to an external log collector so they are retained independently of the appliance and can be correlated with other security telemetry.

Connecting Password Safe audit and session data to a security information and event management platform so alerts, correlation rules, and long-term retention can include credential-access activity.

A collection of users administered as a unit for access assignment, approval routing, and reporting, so that policy changes apply consistently rather than being repeated per person.

A managed system record in Password Safe that groups the accounts, policies, and platform settings associated with one target, and to which access is granted and audited.

Connecting Password Safe to an external identity directory so users, groups, and authentication are sourced centrally, reducing duplicate accounts and simplifying joiner, mover, and leaver handling.

Requiring more than one independent proof of identity at login, such as a password plus a one-time code, which strengthens protection against stolen or guessed credentials.

An arrangement in which a user authenticates once to a trusted identity provider and is then granted access to Password Safe without a separate credential prompt, often paired with stronger authentication.

A credential value valid for a single use or very short interval, sometimes used for accounts that cannot be rotated automatically, so a captured value has minimal value to an attacker.

The reason a user supplies when requesting credential access or a session, which approvers review and which is preserved in the audit trail to support later accountability checks.

An emergency path that lets a designated user obtain critical credentials when normal approval is unavailable, tightly scoped and heavily alerted so it cannot become routine.