CyberArk Guardian key terms

The discipline of controlling, monitoring, and auditing accounts with elevated rights such as root, domain administrator, or database owner, so that standing power is reduced and every privileged action is attributable to a person or workload.

Storing privileged credentials in a hardened, encrypted repository that controls who may retrieve them, rotates them automatically, and logs each checkout so administrators never need to know the underlying password.

Granting only the permissions required for a specific task, for the shortest time needed, so that compromise of one identity limits blast radius. Applied to humans through role scoping and to machines through narrow secret permissions.

Elevation granted on demand for a bounded window after approval or policy evaluation, then automatically revoked. It replaces always-on administrator rights and produces an auditable record of why each elevation occurred.

Persistent, always-active permissions that remain assigned whether or not the holder needs them. Standing privilege is the primary target of attackers and the main thing just-in-time and zero-standing-privilege models try to eliminate.

Capturing keystrokes, screen output, and commands during a privileged session so reviewers can reconstruct exactly what was done. Recordings support incident investigation and compliance evidence, and may trigger live alerts for risky commands.

Proxying a privileged connection so the user's workstation never holds the target credential and never connects directly to the server. The proxy injects credentials, enforces policy, and records activity in the middle.

A workflow in which a user requests a credential, receives exclusive use for a period, and returns it afterward. Exclusive checkout prevents two people using the same account simultaneously, which would destroy accountability.

A rule requiring two authorized people to approve or jointly perform a sensitive action, such as revealing a highly privileged password. It defends against insider misuse because no single person can complete the action alone.

Automatically changing a password, key, or token on a schedule or after use so that leaked or stale secrets stop working. Rotation must be coordinated with dependent services to avoid outages from mismatched credentials.

A hardened intermediary host through which administrators reach protected systems. All privileged connections terminate there, centralizing authentication, network filtering, and logging instead of exposing management interfaces directly.

A tamper-evident chronological record of who accessed what, when, from where, and what they did. It is the evidence base for investigations and regulatory reporting, and must be retained and protected from modification by the subjects it records.

Protecting workforce and third-party accounts through strong authentication, adaptive policy, and lifecycle controls, on the assumption that user credentials are frequently phished, reused, or over-provisioned and therefore need continuous verification.

Requiring two or more independent evidence types, such as a password plus a hardware token or biometric, before granting access. Phishing-resistant factors bound to the origin are preferred over codes that can be relayed by an attacker.

Authentication methods cryptographically bound to the legitimate destination, such as FIDO2 security keys or passkeys, so a fake site cannot relay the response. One-time codes and push approvals are weaker because they can be proxied in real time.

Evaluating context such as device posture, location, network, and behavior at login, then choosing whether to allow, challenge, or block. Risk signals drive the decision rather than a fixed rule for every session.

Requesting additional proof when a user attempts a more sensitive action or when risk rises mid-session, without forcing a full re-login. It balances friction against protection for high-value operations.

Scoring each access request from signals like impossible travel, unfamiliar device, or anomalous command patterns, then applying policy proportional to that score. High-risk requests may be denied or require approval.

Baselining normal activity for users and entities, then flagging deviations such as unusual hours, volumes, or peer-group comparisons. Alerts help detect compromised accounts that authenticated successfully with valid credentials.

The joiner-mover-leaver process that creates accounts, adjusts access as roles change, and disables identities at departure. Weak leaver handling leaves orphaned accounts that attackers prize because nobody monitors them.

An account still enabled after its owner left or changed roles, with no valid human sponsor. Orphaned accounts accumulate privilege, escape review, and are a common foothold, so periodic reconciliation against authoritative sources is required.

The practice of storing, distributing, rotating, and auditing nonhuman credentials such as API keys, database passwords, certificates, and tokens so applications obtain them programmatically instead of embedding them in code or configuration files.

A centralized service that encrypts secrets at rest, authenticates the requesting workload, authorizes access by policy, and logs retrieval. Applications fetch secrets at runtime, removing them from source code and build artifacts.

A credential generated on demand for a specific consumer with a short lifetime, such as a temporary database user created and then destroyed. Because it never persists, theft has limited value and rotation becomes unnecessary.

A short-lived token or key that expires automatically after minutes or hours, often issued in exchange for a workload's proven identity. Short lifetimes shrink the window in which a stolen credential remains usable.

The bootstrap credential a workload uses to prove its identity to the secrets manager before it can retrieve anything else. If secret zero is static and embedded, it becomes the weakest link in the whole chain.

Uncontrolled proliferation of credentials across repositories, CI variables, chat logs, configuration files, and developer machines. Sprawl makes rotation impossible to complete and widens exposure when any single location leaks.

A verifiable identity assigned to a nonhuman entity such as a container, service, or pipeline, used to authenticate to other systems. It replaces shared static keys with platform-issued assertions tied to the workload itself.

Evidence a platform presents about a workload, such as signed metadata describing its namespace, image, or node, which the secrets manager validates before issuing credentials. It binds secret access to verified workload properties rather than a shared password.

Trading one identity assertion for a scoped, short-lived access token from a trusted issuer, avoiding long-lived static keys. The resulting token carries limited audience and duration, reducing the impact of interception.

Any machine or software identity that authenticates without a person present, including service accounts, API clients, bots, certificates, and workloads. These identities often outnumber humans and frequently carry excessive, unmonitored privilege.

A certificate- or key-based identity used by servers, devices, or services to authenticate to each other. Managing its issuance, renewal, and revocation prevents expired certificates causing outages and unrevoked ones enabling impersonation.

Automating discovery, issuance, renewal, and revocation of TLS and client certificates across an estate. It prevents expiry-driven outages and ensures compromised certificates are revoked promptly rather than lingering until natural expiration.

An identity representing an autonomous AI agent that acts toward goals, calls tools, and may spawn subtasks. It needs its own scoped credentials, delegated permissions traceable to a human or system principal, and guardrails limiting what it can reach.

Granting an agent permission to act on behalf of a user or service with explicit scope and consent, so actions remain attributable to the originator. Over-broad delegation turns an agent into a confused deputy with the user's full rights.

Policy controls constraining what an autonomous agent may do, such as permitted tools, spend limits, data boundaries, and approval gates for destructive actions. They are enforced outside the model so prompt injection cannot simply remove them.

An attack that hides instructions in content an agent processes, causing it to take unintended actions with its own privileges. Because the model cannot reliably distinguish data from instructions, containment must come from identity and authorization limits.

The processes of access certification, role modeling, segregation-of-duties analysis, and policy enforcement that keep entitlements aligned with business need. It answers who should have access, who approved it, and whether it is still justified.

Periodic review in which managers or resource owners confirm or revoke each entitlement. Evidence of the review satisfies auditors and surfaces accumulated privilege that automated provisioning alone would not catch.

Splitting conflicting responsibilities, such as creating a vendor and approving its payment, across different identities so no one can commit and conceal fraud alone. Violations are detected by analyzing entitlement combinations, not individual permissions.

Automatically creating, updating, and removing accounts and entitlements based on authoritative identity data or approved requests. Good provisioning prevents both access gaps on day one and residual rights after role changes.

Explicit, recorded permission from a user or owner allowing an application or agent to access specific resources on their behalf. Consent records enable revocation and are essential when autonomous agents act for people.