Overview

Keeper EPM is a Privileged Elevation and Delegation Management (PEDM) solution

Overview

Keeper Endpoint Privilege Manager (KEPM) is a Privileged Elevation and Delegation Management (PEDM) solution. It controls privilege elevation, file access, application execution, command-line activity, agentic AI activity, and outbound network access across Windows, macOS, and Linux.

KEPM lets users work without standing admin rights. Security teams still get policy control, audit visibility, and consistent enforcement.

What KEPM does

KEPM helps you:

• Control elevation, file access, commands, AI agents and DNS access
• Remove standing local admin rights
• Require MFA, approval, or justification for sensitive actions
• Enforce policy across Windows, macOS, and Linux
• Audit every decision and workflow outcome

Endpoint Discovery and Governance

Policies are defined in the Keeper Admin Console and enforced locally by the endpoint agent. Elevation attempts, file access, commands, AI agent actions, policy matches, and approvals are all auditable.

KEPM strengthens governance with centralized approvals, detailed audit trails, granular policy controls, AI agent governance, and built-in resilience.

Core capabilities

• Agent-based deployment across Windows, macOS, and Linux
• Least-privilege enforcement for users and workloads
• Just-in-time elevation at the process or machine level
• Approval workflows with MFA and justification
• Agentic AI detection and governance
• DNS-based zero trust controls
• Detailed audit and reporting
• Integrations with ITSM and security workflows

Governance and audit

KEPM gives security teams clear, usable visibility:

• Audit events for elevation, file access, commands, AI activity, and policy evaluation
• Visibility into which policy matched and why
• Tracking for justifications, MFA, and approvals
• Event streams for SIEM and security monitoring tools

The same policy model also supports workflows such as MFA challenges, approval routing, justification capture, redirects, custom filters, and jobs.

Zero-standing privilege

KEPM helps organizations move to zero-standing privilege:

• Users are not local administrators by default
• Elevation is requested only when needed
• Policies decide whether to allow, deny, require MFA, require justification, or require approval

The Least Privilege policy removes local admin rights on managed devices. On Windows, users are removed from the local Administrators group. On macOS and Linux, users are removed from sudo.

Privileged actions run through a Keeper-managed ephemeral account.

For rollout guidance, see Policy: Phased Rollout Planning.

Policy coverage

KEPM provides fine-grained, application-aware enforcement.

Privilege elevation

• Target specific applications, command lines, users, groups, or machines.
• Apply Allow, Deny, MFA, Justification, or Approval actions per policy
• Elevate processes without elevating the entire user account
• Grant time-bound elevation using a configurable duration

File and data access

• Allow, deny, or gate access to files or folders
• Require justification or approval for sensitive access
• Flag individual files as sensitive to trigger approval on access
• Grant time-bound access using a configurable duration

Command line control

• Define rules for commands or patterns
• Apply policies to CLI-triggered activity
• Govern sudo usage through keepersudo on macOS and Linux

Agentic AI governance

• Detect known AI agents (such as GitHub Copilot, Cursor, and Claude Code) and flag unknown processes that behave like AI agents
• Monitor agent activity and assign a risk score to the actions agents take
• Govern what agents are allowed to do — gate access to sensitive files, privileged commands, or network destinations
• Require human-in-the-loop approval (end-user or administrator) before an agent performs a sensitive operation
• Trigger response actions when an agent's risk score exceeds a defined threshold

Network access

• Evaluate outbound DNS resolutions against allowed and denied hostname patterns
• Allow, deny, or hold a query pending justification, MFA, or approval
• Scope controls per user, machine, application, or AI agent
• Issue time-bounded DNS access grants so repeated, approved queries proceed without re-evaluation

Variables, wildcards, and collections let you scale policy targeting without maintaining long rule lists.

ZTNA DNS controls are available on Windows endpoints.

Inventory and risk visibility

The Admin Console also surfaces endpoint inventory to support detection and policy authoring:

• Agentic AI Inventory for known and possible AI agents
• Certificate Inventory with validity status and CVE risk
• Product Inventory with software versions and CVE-based risk scoring

Admin experience

Dashboard

The Keeper Admin Console is the central administration console for EPM. The default Dashboard contains all recent events, including any events in monitoring mode.

EPM Dashboard

From the dashboard, administrators can:

• Activate EPM and manage licensing.
• Create and manage Policies across the fleet.
• Define Collections for applications, machines, users, DNS names, command-line arguments, and AI agents.
• Configure Approvers and approval workflows.
• Manage Deployment Groups.
• Monitor Deployments and endpoint status.
• Review AI agent risk and endpoint inventory.
• Review Requests and approval history.
• Access detailed Audit History and reporting data.

Administrators manage once in the dashboard. Policies are enforced everywhere by the agent.

Deployment groups and targeting

Deployment Groups allow staged rollout and granular targeting.

Deployment Groups and Targeting

You can:

• Deploy in phases (test → pilot → department → enterprise).
• Scope policies by:

  • User or Group
  • Machine
  • Application
  • AI Agent
  • DNS Name
  • Platform
• Tune policy modes using:

  • Off
  • Monitor
  • Monitor & Notify
  • Enforce

This ensures safe rollout and governance precision. Agentic AI policies default to Monitor mode so teams can observe agent behavior before enabling enforcement.

Policies

KEPM within KeeperPAM

Keeper Endpoint Privilege Manager is part of the broader KeeperPAM platform. KeeperPAM combines:

• Password Management: Secure storage and rotation of credentials
• Secrets Management: Control of application secrets and API keys
• Zero Trust Network Access: Secure, verified remote connections
• Connection Management: Streamlined access to remote systems
• Secure Tunneling: Protected pathways to sensitive resources

KEPM extends Zero Trust principles directly to the endpoint by controlling local privilege, application execution, agentic AI activity, and outbound DNS resolution.

While KeeperPAM secures access to infrastructure, sessions, and credentials, KEPM governs what users and AI agents can do on the endpoint after access is granted.

End-User Experience

KEPM is designed to enable productivity while maintaining security.

Users running the Keeper agent can see applied policies, approvals, and elevation requests. The UI is available on Windows, macOS, and Linux.

• Users request elevation when needed
• Clear dialogs explain required justification or MFA
• Approved actions proceed seamlessly
• Users may be asked to approve or deny an AI agent's action when a policy requires human-in-the-loop review
• Redirects offer secure alternatives rather than hard denials
• Elevation is temporary and policy-controlled

The experience is consistent across supported platforms.

Windows

When a Windows user runs an application that requires elevation:

• The EPM dialog displays justification and/or MFA requirements
• Approval workflows trigger if required
• Elevation is time-bound and policy-controlled

Windows OS Elevation

macOS

On macOS, elevation and file access controls use the same policy model:

• Users see native-style dialogs for justification or MFA.
• Policies govern GUI apps and command-line tools.

macOS Elevation

Linux and command line

On Linux, EPM enforces policy through controlled elevation flows:

• CLI activity is governed via keepersudo.
• Policy evaluation occurs before privileged execution.

Linux Device Running GNOME

On macOS and Linux, Keeper protects sudo through the Command Line policy type. Users elevate through keepersudo.

Linux Desktop Running GNOME

In the example below, the user requests elevation to root and an admin approves it.

Linux SSH Session with Elevation Request

Elevation approvals

Administrators can approve requests in the Keeper Admin Console, Commander CLI, or connected applications.

Approval of a Command Line Elevation Request

Operational Flexibility

KEPM supports phased rollout, dynamic configuration, plugin and job management, agent updates with version pinning, scalable targeting with variables and wildcards, and offline registration for air-gapped environments.

Integrations

Keeper Endpoint Privilege Manager integrates with popular enterprise tools for approval automation, reporting and alerting. Examples include:

• ServiceNow - Workflow requests approvals and ITSM ticket generation
• Jira - Workflow requests, approvals and ITSM ticket generation
• Slack App - Approve or deny elevation requests from your Slack App
• Teams - Approve or deny elevation requests from your Teams app

Automation

Keeper Commander CLI supports full automation of any operation of the endpoint privilege manager workflows, approvals, deployments, discovery, reporting and policy management.

• Keeper Commander CLI - EPM Commands