Password Safe Fundamentals and Architecture
Core model
BeyondTrust Password Safe is a privileged credential management appliance that sits between administrators and the systems they manage. The core components you must name are the Password Safe appliance (the hardened, policy-enforcing server), the web management interface, the agents installed on managed systems, and the clients administrators use to launch sessions. Credentials and session data live in an encrypted vault on the appliance; agents let Password Safe perform password changes and proxy sessions without exposing secrets to the user.
Roles and trust boundaries
Understand the separation between password management (checkout, release, rotation) and session management (proxy, recording, playback). They share the vault and policy engine but are distinct workflows. The appliance enforces policy; the user never sees the plaintext password unless policy allows it. This is the central trust boundary: secrets flow from vault to target through the appliance, not through the administrator's clipboard.
Traps
Questions often confuse the agent with the proxy: agents rotate passwords and enable management, while sessions are brokered by the appliance. Another trap is assuming the vault is external - it is embedded in the appliance. Also watch for the difference between managed systems (with agents) and unmanaged targets where rotation may be limited.
Rule of thumb
If a scenario asks "where does the password change happen?" the answer is the agent on the managed system, driven by appliance policy - not the administrator's workstation.