Access Control, Approval Workflows, and Session Management
Access control
Password Safe uses role-based access control layered with access policies. Roles grant capabilities (admin, auditor, user); policies determine which managed systems and accounts a user can reach and under what conditions. Access policy sets bind users or groups to assets with rules for checkout, approval, and session rights.
Approval workflows
When policy requires it, a checkout triggers an approval request routed to designated approvers. Understand request lifecycle: pending, approved, denied, expired. Approvals can be time-bound, and emergency access paths may bypass normal approval under audit. Traps include assuming approval is global - it is per policy and per request - and confusing approver roles with administrator roles.
Session management
Session brokering proxies connections (RDP, SSH, and similar) through the appliance. Sessions can be recorded for audit and played back later. Session policies control who may launch, whether recording is mandatory, and whether keystroke logging applies. Understand that the proxy terminates the connection at the appliance, so the target sees the appliance, not the user.
Rule of thumb
Ask: does the policy govern the credential (checkout/approval) or the connection (session/recording)? Many exam items hinge on that distinction. A user may be approved for checkout yet denied session launch if session policy differs.
Trap
Recording is not the same as live monitoring; and approval for checkout does not automatically grant session rights.