# Privileged Access Management

> Design just-in-time elevation, break-glass accounts, and audit trails for Modify All Data / System Admin / Customize Application permissions. NOT for regular permission set design.

- Skill: `banibratachatterjee/privileged-access-management` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add banibratachatterjee/privileged-access-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/banibratachatterjee/privileged-access-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: BanibrataChatterjee (https://skillmd.com/u/banibratachatterjee)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/banibratachatterjee/privileged-access-management

---


# Privileged Access Management (PAM)

Salesforce System Administrators hold the highest-risk permission in the platform. PAM narrows standing admin count to two (break-glass), grants temporary elevation via time-boxed Permission Set Groups with expiration, and mirrors all admin-scoped actions to a SIEM via Event Monitoring.

## When to Use

Orgs with >5 named System Administrators, regulated industries, or SOC 2 readiness. Not for small sandboxes without production data.

Typical trigger phrases that should route to this skill: `system admin break glass account`, `too many modify all data users`, `just in time admin elevation`, `root account security salesforce`.

## Recommended Workflow

1. Inventory every user with System Administrator profile or Modify All Data permission.
2. Define three tiers: (1) Daily admin PSG — no Modify All Data, Customize Application only where needed; (2) Elevated PSG — full admin, auto-expires in 4h; (3) Break-glass — 2 named users, MFA + IP restriction.
3. Implement a request workflow (Flow or Jira integration) where admins request the Elevated PSG; grant uses PermissionSetAssignment.ExpirationDate.
4. Stream LoginHistory, SetupAuditTrail, and PermissionSetAssignment change events to SIEM via Event Monitoring.
5. Quarterly review: prove that standing admin count is ≤2 and elevated grants are ≤N hours median.

## Key Considerations

- PermissionSetAssignment.ExpirationDate is GA; use it instead of custom revoke schedulers.
- Break-glass users should have 24/7 paging and session-recorded logins.
- MFA is mandatory for anyone in the Elevated or Break-glass tiers.
- SetupAuditTrail retains 180 days of config changes; longer retention requires Event Monitoring + archive.

## Worked Examples (see `references/examples.md`)

- *Elevated PSG with 4-hour expiration* — ServiceNow ticket approves admin request.
- *Break-glass alert* — Break-glass user logs in.

## Common Gotchas (see `references/gotchas.md`)

- **ExpirationDate ignored for Permission Set Group licenses** — License-required PSGs don't auto-expire on all editions.
- **Setup Audit Trail gaps** — Certain configuration changes are not logged.
- **Break-glass account shared** — One account used by multiple humans; no personal accountability.

## Top LLM Anti-Patterns (full list in `references/llm-anti-patterns.md`)

- Assigning System Administrator profile as the baseline for IT staff
- Sharing a single break-glass account across the team
- Granting Elevated PSG without expiration

## Official Sources Used

- Apex Developer Guide — Sharing — https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_bulk_sharing_understanding.htm
- Salesforce Security Guide — https://help.salesforce.com/s/articleView?id=sf.security.htm
- Shield Platform Encryption — https://help.salesforce.com/s/articleView?id=sf.security_pe_overview.htm
- Session Security Levels — https://help.salesforce.com/s/articleView?id=sf.security_hap_session.htm
- CSP and Trusted URLs — https://help.salesforce.com/s/articleView?id=sf.security_csp_overview.htm
- API Only User Profile — https://help.salesforce.com/s/articleView?id=sf.users_profiles_api_only.htm
- Privacy Center and DSR — https://help.salesforce.com/s/articleView?id=sf.privacy_center_overview.htm