An admin avatar sits left of a central PAM vault/proxy; a critical server (root / domain-admin target) sits on the right; a small audit log archive sits behind the vault.
In standing access mode the admin already holds permanent root rights — a solid green line connects admin straight to the server at all times, with no vault in the loop, no timer and nothing recorded. This is the legacy pattern PAM replaces: a credential that sits valid for months, rarely reviewed, and a full-time target for attackers.
In JIT PAM mode the admin holds no standing rights. Clicking Request elevated access sends a request pulse to the vault; the vault approves it, mints a fresh one-time credential, and opens a proxied session to the server — the admin authenticates through the proxy and never sees the real root password (credential vaulting). A countdown bar over the admin burns down the elevation window while a REC indicator and periodic pulses to the audit log show the session being recorded for audit (session recording). The instant the timer hits zero, the proxied connection is cut, the vault rotates the credential to a new random value, and the admin returns to zero standing privilege until the next request.
standing: admin --root(forever)--> server (unbounded exposure)
JIT PAM: admin --request--> vault --mint,proxy,record--> server
access revoked + credential rotated at T = window
- Elevation window — how long a JIT grant stays valid before automatic revocation.
- Password rotations — how many times the vault has re-rolled the server's root credential.
- Sessions recorded — how many elevated sessions were captured in the audit log.
Real-world relevance: this mirrors PAM tools (CyberArk, BeyondTrust, Teleport-style JIT access) that remove standing root/domain-admin rights from humans, replace them with time-boxed elevation on request, vault the actual credential so the operator never learns it, and record every privileged session for audit — the combination that shrinks the highest-value attacker target on a network from "always available" to "available for a known, bounded window, on the record."