Design Privileged Access Management - System Design | WinJob

Problem Statement & PAM Control Plane

Privileged Access Management (PAM) is the security control plane for admin power: it vaults root/domain/cloud credentials, forces check-out with justification, brokers SSH/RDP/K8s sessions through a monitored path, and rotates secrets after use. This section (pam-control-plane-vault broker session recording JIT elevation) focuses on vault broker session recording JIT elevation.

Key points

Vault never returns long-lived passwords to endpoints; brokers inject ephemeral credentials
Every privileged session emits tamper-evident audit events to SIEM within 5 seconds
Just-in-time elevation binds role activation to ticket id, approver id, and hard TTL

Deep dive

CyberArk-, BeyondTrust-, and HashiCorp-class interviews expect you to separate governance (who may request) from execution (how connection happens). Problem Statement & PAM Control Plane must show that shared break-glass accounts are eliminated: each checkout creates a lease row, broker token, and recording handle. When an operator runs sudo on a bastion, the command stream is tagged with session_id so SOC can replay without trusting host syslog.

Capacity for pam-control-plane: assume 4,000 production targets, 12% concurrently under change windows, 220 admin operators, and 35% requiring video capture. Checkout API stays under 500ms p99 including step-up MFA; rotation worker clears 98% of leases within 60s after session.end. Emergency break-glass bypasses approval but doubles audit sampling and pages security on-call.

Threat modeling slice: stolen broker certificates, colluding approver + operator, vault operator with decrypt keys, and slow rotation leaving windows for lateral movement. Mitigate with HSM-wrapped DEKs, dual-control for break-glass, rate limits on checkout per user/target, and deny checkout when target health checks fail.

Implementation sketch

javaOne Dark Pro

1 public final class PamLease1 {
2   private final String leaseId;
3   private final String targetId;
4   private final Instant expiresAt;
5   public boolean isExpired(Instant now) { return now.isAfter(expiresAt); }
6   public String brokerSubject() { return "pam:" + leaseId + "@" + targetId; }
7 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2 from datetime import datetime, timezone
3  
4 @dataclass(frozen=True)
5 class CheckoutRequest1:
6     user_id: str
7     target_id: str
8     justification: str
9     ticket_id: str
10     ttl_minutes: int
11  
12     def audit_payload(self) -> dict:
13         return {"user": self.user_id, "target": self.target_id, "ticket": self.ticket_id}

typescriptOne Dark Pro

1 interface PamSession1 {
2   sessionId: string;
3   leaseId: string;
4   brokerHost: string;
5   recordingUri: string;
6   startedAt: string;
7 }
8  
9 export function shouldTerminate(s: PamSession1, ttlMinutes: number): boolean {
10   const start = Date.parse(s.startedAt);
11   return Date.now() - start > ttlMinutes * 60_000;
12 }

Operational notes

Note 1.1: For Problem Statement & PAM Control Plane, emphasize vault with measurable SLO 87ms and audit correlation id 100.

Note 1.2: For Problem Statement & PAM Control Plane, emphasize broker with measurable SLO 90ms and audit correlation id 101.

Note 1.3: For Problem Statement & PAM Control Plane, emphasize session with measurable SLO 93ms and audit correlation id 102.

Note 1.4: For Problem Statement & PAM Control Plane, emphasize recording with measurable SLO 96ms and audit correlation id 103.

Note 1.5: For Problem Statement & PAM Control Plane, emphasize JIT with measurable SLO 99ms and audit correlation id 104.

Note 1.6: For Problem Statement & PAM Control Plane, emphasize elevation with measurable SLO 102ms and audit correlation id 105.

Note 1.7: For Problem Statement & PAM Control Plane, emphasize vault with measurable SLO 105ms and audit correlation id 106.

Note 1.8: For Problem Statement & PAM Control Plane, emphasize broker with measurable SLO 108ms and audit correlation id 107.

Note 1.9: For Problem Statement & PAM Control Plane, emphasize session with measurable SLO 111ms and audit correlation id 108.

Note 1.10: For Problem Statement & PAM Control Plane, emphasize recording with measurable SLO 114ms and audit correlation id 109.

Note 1.11: For Problem Statement & PAM Control Plane, emphasize JIT with measurable SLO 117ms and audit correlation id 110.

Note 1.12: For Problem Statement & PAM Control Plane, emphasize elevation with measurable SLO 80ms and audit correlation id 111.

If challenged on Problem Statement & PAM Control Plane, cite checkout p99, rotation SLA, recording integrity hash, and break-glass dual control—not a vague "we vault passwords" answer.

Why interviewers care

Privileged Access Management interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement & PAM Control Plane that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Vault leases replace shared root passwords
•Brokers enforce TTL and capture privileged actions
•Rotation-on-end closes credential exposure windows

1	public final class PamLease1 {
2	private final String leaseId;
3	private final String targetId;
4	private final Instant expiresAt;
5	public boolean isExpired(Instant now) { return now.isAfter(expiresAt); }
6	public String brokerSubject() { return "pam:" + leaseId + "@" + targetId; }
7	}

1	from dataclasses import dataclass
2	from datetime import datetime, timezone
3
4	@dataclass(frozen=True)
5	class CheckoutRequest1:
6	user_id: str
7	target_id: str
8	justification: str
9	ticket_id: str
10	ttl_minutes: int
11
12	def audit_payload(self) -> dict:
13	return {"user": self.user_id, "target": self.target_id, "ticket": self.ticket_id}

1	interface PamSession1 {
2	sessionId: string;
3	leaseId: string;
4	brokerHost: string;
5	recordingUri: string;
6	startedAt: string;
7	}
8
9	export function shouldTerminate(s: PamSession1, ttlMinutes: number): boolean {
10	const start = Date.parse(s.startedAt);
11	return Date.now() - start > ttlMinutes * 60_000;
12	}