Identity and Access
Privileged access management tools that expire the admin (2026)
A 2026 shortlist of controls for standing admin. Public docs, not a lab bake-off.
Expertise: Identity and Access · Level: Intermediate · 12 min read
A shared root password is a standing incident.
The admin role never expired. The contractor left. The jump box still has their key. PAM is expire, record, and approve. It is not the workforce IdP. The identity list already covers Okta and Keycloak.
Six controls. Two open access planes. One known vault. Two commercial brokers. One identity-aware proxy. Public docs and licenses. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Teleport | SSH Kubernetes and app access with short certs | AGPL-3.0 / commercial |
| Boundary | HashiCorp sessions to private endpoints | BUSL / HashiCorp terms |
| CyberArk | Classic privileged vault and session | Commercial |
| StrongDM | Commercial proxy to infra | Commercial |
| Delinea | Secret Server and privilege on Windows estates | Commercial |
| Pomerium | Identity-aware proxy you can host | Apache-2.0 |
Teleport
Best for sSH Kubernetes and app access with short certs
Teleport issues short-lived certificates for SSH, Kubernetes, and web apps. The core is open. Enterprise is paid.
Key features
- Short-lived certs
- Audit of sessions
- Kubernetes access
- Self-host or cloud
Why we like it
This is the hidden gem for teams who can host a plane. The certificate expires. That is the job.
Limits
AGPL-3.0 on the core. Enterprise features are paid. You still connect it to an IdP.
Boundary
Best for hashiCorp sessions to private endpoints
Boundary brokers a session to a private IP without putting a standing key on the laptop. It sits next to Vault in the HashiCorp story.
Key features
- Just-in-time targets
- Workers you deploy
- Vault integration
- Identity-aware
Why we like it
If Vault already holds the secret, Boundary is the session that does not copy it onto disk.
Limits
BUSL is not Apache. You operate workers. This is not a password vault UI.
CyberArk
Best for classic privileged vault and session
CyberArk is the known PAM shelf. Vaulting, session isolation, and privilege. The identity list already puts it on the matrix as the privileged specialist.
Key features
- Password vault
- Session recording
- Privilege on the endpoint
- Enterprise connectors
Why we like it
Procurement already wrote this name. We keep it so the open planes have a neighbor. Link the identity list for the IdP job.
Limits
Sales-led. We did not run a vault. This page does not reprint the identity six.
StrongDM
Best for commercial proxy to infra
StrongDM is a commercial access proxy. People, roles, and audit on the path to the database and the cluster.
Key features
- Proxy to infra
- Identity from your IdP
- Session logs
- Least privilege grants
Why we like it
When the team will not host Teleport, this is a commercial shape of the same job.
Limits
Price is commercial. You still map roles. We did not run a tenant.
Delinea
Best for secret Server and privilege on Windows estates
Delinea is Secret Server and privilege products. Common on Windows-heavy estates.
Key features
- Secret Server
- Privilege manager
- Session control
- Enterprise directory hooks
Why we like it
If the standing admin is a domain admin, this is a shelf those teams already know.
Limits
Commercial. Not a cloud-native cert plane. We did not run it.
Pomerium
Best for identity-aware proxy you can host
Pomerium is an identity-aware proxy. Access policies sit on the route. The core is Apache-2.0. Also on the ZTNA list as a cousin.
Key features
- Policy on the URL
- IdP in front
- Self-host
- TCP and HTTP routes
Why we like it
When the admin tool is a web app, a proxy that expires the session is PAM-shaped even if the brochure says ZTNA.
Limits
You operate the proxy. It is not a password vault. Link ZTNA if the job is the path, not the privilege.
What the internet thinks about PAM tools
Teleport’s early HN threads already treat the IdP as the front door. PAM still has to expire the session after that.
alexk on Hacker News, Sep 2016: “We wanted to support Google auth out of the box and OIDC is a good way to get this plus give options for pluggable auth to everyone else.”
Prove Teleport still publishes the plane
Confirm Teleport’s public repo still advertises an access plane. Do not expose a jump box to the internet for this check.
curl -fsSIL https://goteleport.com/ | head -n 8FAQs
Does PAM replace the IdP?
No. The IdP says who logged in. PAM says the admin session ends. Link identity protection.
Is Teleport ZTNA or PAM?
Both, for different buyers. This page is the privileged session. The ZTNA list is the path to the app.
Can I keep a shared root?
No. That is the hole. A vault that still hands out a standing password is the wrong door.
Is this a scored bake-off?
No. Order is editorial. We did not install CyberArk.
