The operator connects. The secret never leaves the broker.
Fidwyn PAM terminates every privileged session at a TLS session broker and injects the credential there. The operator never sees, holds or exfiltrates the password. Access flows through three modes: an isolated per-session browser in Docker, direct application launch on the target authenticated by a PAM token, or the user's own client connecting with a token issued from the API or the console. Every keystroke, query and screen is recorded and searchable.
Standing credentials are the breach.
Shared admin passwords in a spreadsheet, service accounts that never rotate, vendors with permanent VPN. Every one is a credential an attacker can steal and reuse. Legacy PAM reduces the problem but still hands the operator the secret at connect time.
Fidwyn closes that gap architecturally. The credential is checked out to the broker, not the user. Injection happens inside the session proxy. The operator authenticates as themselves, gets a time-boxed grant, and connects. They never possess the target secret, so they cannot leak it.
What Fidwyn PAM actually does.
Grounded in the shipping console. Every item below is a screen an administrator uses.
The vault for Windows, Linux and Unix, MS SQL Server, MySQL, PostgreSQL and Oracle accounts. Checkout- and reveal-gated, with personal vaults isolated per user.
Rotate a single account or every account matching an OS type on an hourly, daily, weekly or monthly schedule. Posture Scanning discovery feeds straight into a rotation task.
Reusable definitions for what a credential is and how it rotates, so onboarding a new system class is a template selection, not a scripting exercise.
No standing privilege. A grant is requested, approved against policy, time-boxed and revoked automatically. Connect over RDP, SSH or an isolated browser; launch applications such as SSMS directly on the target with token-based authentication, no RDS required; and block chosen applications on the target for the duration of the session, with no agent on the target.
A program view that tracks standing-access coverage, converts accounts to JIT-only, enrolls and rotates them, and deprovisions what should not exist.
SSH and terminal captured as replayable asciinema, RDP and browser as MP4, with keystroke logs alongside. Watch, join or cut a live session as an administrator. Video, keystroke capture and application blacklisting apply across all four channels: RDP, SSH, SQL and browser.
A statement-level proxy that allows, blocks or audits by command, identity or group and masks columns inline. Database Queries logs every statement with its verdict.
A lifecycle for non-human accounts that are discovered, assigned, managed and owned, with an attestation queue that forces periodic ownership review and retires the orphaned.
Multi-approver policies with backup approvers, maximum duration and auto-reject on timeout. Requesters and approvers each work a scoped queue.
A fine-grained permission model granted across users, systems, roles, groups and tenants, visualized on the Access Map and enforced by one resolver.
Why the SQL proxy is inline, not a sidecar.
Database access is where audit usually goes dark. A tunnel-only PAM records that a DBA connected, then loses sight of what they ran.
Fidwyn's proxy speaks the database wire protocol. It sees every statement, evaluates it against your rules before it reaches the engine, and can mask returned columns on the way back. The DBA gets a normal client experience. You get a verdict on every DROP TABLE, allowed or blocked and logged with identity.
Inline statement audit
Take the secret out of human hands.
See a brokered RDP, SSH and SQL session where the operator never touches the credential.