> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/privileged-access-manager/just-in-time-access-jit/workflow.md). # Workflow and Approvals Enterprise-grade control over privileged access, enforcing approvals, time-bound limits, and automatic credential rotation to eliminate standing privilege.

## Overview Workflow controls how users request, receive, and use privileged access to PAM resources. Configure time limits, approvals, single-user checkout, and MFA to enforce just-in-time access. Access ends when the approved window expires or the record is checked in. KeeperPAM then removes active connections and rotates credentials. This guide shows how to configure Workflow for PAM records in the Keeper Vault. {% embed url="" %} **Key Features:** * **Multi-Level Approvals** — Approval workflows can require sign-off from multiple approvers or delegated approval authority * **Single-User Mode (Check-in / Check-out)** — Only one user can access the resource at a time. Users must check out the resource before use and check it back in when finished. If not returned manually, access is automatically revoked when the time limit is reached. * **MFA Requirement** — Users must complete multi-factor authentication before access is granted. * **Access Time Limits** — Access is granted for a defined duration and automatically revoked when the time window expires. * **Real-Time Notifications** — Approvers receive notifications across all Keeper clients, including desktop, web, and mobile. ## Prerequisites Prior to configuring Workflow, make sure to have the following: ### Workflow Enforcement Policy Enforcement policies for KeeperPAM are managed in the Keeper Admin Console under **Admin** > **Roles** > **Enforcement Policies** > **Privileged Access Manager**. The following Enforcement Policies affect user's permissions to configure Workflow settings on PAM Record types and need to be enabled:

Enforcement Policy	Commander Enforcement Policy	Definition
Can manage workflow settings	`ALLOW_CONFIGURE_WORKFLOW_SETTINGS`	Allow users to configure Workflow settings on PAM Machine, PAM Directory, PAM Database, and PAM Browser

Workflow Enforcement Policy can also be enabled on the [Keeper Commander CLI](https://docs.keeper.io/en/keeperpam/commander-cli/command-reference/secrets-manager-commands#overview) using the `enterprise-role` command: ``` enterprise-role "My Role" --enforcement "ALLOW_CONFIGURE_WORKFLOW_SETTINGS":true ``` ### PAM Machine, PAM Database, PAM Directory, PAM Browser Configuring workflow allows you to manage how privileged access is requested, approved, and used on target endpoints. The target endpoint needs to be defined on one of the following PAM Record types:

PAM Record Type	Target Endpoint type
PAM Machine	Windows/MacOS/Linux Machines, EC2 Instances, Azure VMs
PAM Database	MySQL, PostgreSQL, SQL Server, MongoDB, MariaDB, Oracle
PAM Directory	Active Directory, OpenLDAP
PAM Remote Browser	Web-based applications

Depending on your target endpoint, visit the corresponding PAM Record Type page for more information on setup. ## PAM Settings - Configuring Workflow Within the **PAM Settings** for a given resource, the **Workflow** tab can be managed by the record owner or by a user with edit permissions and the required console enforcement for **Can manage workflow settings**. ### Navigate to Workflow Settings On a PAM Machine, PAM Database, PAM Directory, or PAM Browser record, navigate to the Workflow tab on the PAM Settings screen by: 1. Editing the PAM Record Type 2. Clicking on "Edit" in the PAM Settings section 3. Navigating to the "Workflow" section in the prompted window Within the PAM Settings for a given resource, the Workflow tab can be managed by the record owner or by a user with edit permissions and the required console enforcement for **Can manage workflow settings**. Privileged access settings are applied at the folder level and can apply to any type of PAM resource, PAM machines, PAM databases, PAM directories, and more. To configure Workflow, open the **Workflow** tab, where you will find four toggle options that can be used independently or together depending on the level of control your organization requires. When combined, these settings define a powerful, layered access policy: specifying when access is permitted, who must approve it, how many users can hold access simultaneously, and whether step-up multi-factor authentication is required before a session begins.

**Limit Access Time** allows administrators to define precisely when a user can access a resource. Configure a time window across specific days and set the maximum duration of access once approved. This establishes enforced, time-bound access in alignment with least-privilege best practices, access is granted only when needed and automatically revoked when the window closes. ### Configuring Workflow On the Workflow tab, The following fields can be configured

Field	Definition
Limit Access Time	When enabled, restricts when and for how long a resource can be accessed. Administrators can define an access schedule (e.g., Monday–Friday, 8:00 AM–5:00 PM) and a maximum access duration (e.g., 2 hours). Access outside the allowed schedule or beyond the time limit is automatically denied or revoked. Note: This is required when enabling Require Approval, Single-User Mode, and MFA
Require Approval	When enabled, users must request and receive approval before accessing the resource. The record owner is added as an approver by default. Additional users can be added to the list of approvers. Optionally, requiring a justification reason or a ticket/issue number with each request can be enabled. Note: Users added as approvers are not required to request access to the resource.
Single-User Mode	When enabled, only one user can check out and use the resource at a time. Access must be checked back in before another user can access it.
Multi-Factor Authentication (MFA)	When enabled, users must complete multi-factor authentication before launching a connection or starting a tunnel. The MFA method configured on the user's Keeper account is used.

These options can be used individually or in combination to match your organization's access policies. Common combinations include: * **Limit Access Time + Require Approval** — The resource can only be accessed during a defined schedule and requires approval before each use. * **Require Approval + Single-User Mode** — Only one user can access the resource at a time, and approval is required before checking it out. * **Require Approval + MFA** — Users must receive approval and complete multi-factor authentication before accessing the resource. * **All Options Enabled** — The resource can only be accessed during a defined schedule, requires approval before use, restricts access to one user at a time, and enforces MFA before launching a connection. #### Limit Access Time Limit Access Time allows you to define when a user can access the resource. You can configure a time window for specific days and set how long access is allowed once granted.

#### Require Approval Require Approval allows you to select one or more approvers from a dropdown list. By default, the record owner is added as an approver. Additionally, any user or team that has access to the record can be selected as an approver. You can configure whether access requires approval from one approver or multiple approvers. **Note:** Users added as approvers are not required to request access to the resource. You can also require the requester to provide a reason for access and/or an issue number as part of the request. Additionally, you can choose when the access window begins: * Upon approval - The access timer starts as soon as the request is approved. * Upon first connection to the resource - The access timer starts when the user launches their first connection after the request is approved. **Require Approval** enables organizations to build a structured approval chain before any privileged access is granted. Select one or more approvers from a dropdown, any user or team with visibility to the record can be designated, including escalated approvers for higher-stakes resources. Configure whether access requires a single approver or multiple approvers before it is granted, and require the requester to submit an approval reason and a ticket or issue number, creating a clear audit trail that ties every access event to a business justification. You can also define when the access window begins: * **Upon approval**, access starts the moment the request is approved * **Upon first connection**, the access clock starts when the user first connects to the resource

Workflow Config with approvers configured

#### Single-User Mode When Single-User Mode is enabled, only one user at a time can be approved to access the resource. Once the resource is checked out, no other user can check it out until that user checks it back in or their access expires. Approvers also have the option to force check in a resource, immediately revoking the current user's access. When **Single-User Mode** is enabled, only one user at a time can hold approved access to the PAM resource during the defined access period. Once a resource is checked out, no other user can check it out until the original user checks it back in or their access expires. This prevents overlapping sessions and supports Zero Standing Privilege by ensuring that access is never shared or duplicated among users. Administrators can also perform a **forced check-in** on any resource currently checked out, providing an additional layer of control when access needs to be revoked immediately. #### Multi-Factor Authentication (MFA) When MFA is enabled, the user is prompted to complete two-factor authentication before launching a connection or starting a tunnel. The MFA method configured on the user's Keeper account is used. When **Multi-Factor Authentication (MFA)** is enabled, the user must complete step-up authentication before launching a connection or starting a tunnel. This ensures that even approved users must verify their identity at the point of access, a critical control for securing high-value assets and meeting compliance requirements. ## Accessing a Record with Workflow Enabled When a record with Workflow enabled is shared with another user, the end user experience will vary depending on which workflow settings are configured. The experience for end users varies depending on how Workflow is configured for the resource they are accessing. ### Single-User Mode When a record with Workflow enabled is shared with you, you will receive a notification. Clicking the notification takes you directly to the record. If Single-User Mode is enabled, the record displays a **Check Out Record** button. Selecting this option checks out the record to you, activates the Launch button, and displays a countdown showing how much time remains before your access expires. You can also manually check the record back in when you are done. While you have the record checked out, no other user can access it, preserving session integrity and supporting a Zero Standing Privilege posture across the organization.

### Approval Process and Justifications If the record requires approval, it will display a **Request Access** button.

After selecting Request Access, you may be prompted to provide an approval reason and a ticket or issue number, both entered as part of the request, depending on how Workflow is configured. This ties every access event to a verified business justification and supports audit and compliance requirements. Once the request is submitted, you can track its status in real time, send a reminder to approvers, or cancel the request. Approvers receive an instant notification in the Keeper Vault's Notification Center, prompting them to approve or deny the request. Approvals can be handled directly from the Vault or Admin Console, no additional tools required. If the request is approved, the record status is updated in the requester's Vault and they are permitted to launch the connection.

After selecting **Request Access**, you may be required to provide a **reason** and/or an **issue number**, which the requester enters as part of the request, depending on how Workflow is configured. Once the request is submitted, you can track its status, send a reminder to approvers, or cancel the request.

Requesting Approval with required approval reason

### Multi-Factor Authentication (MFA) When MFA is enabled, the user is prompted to enter their two-factor authentication code when launching a connection. The 2FA method configured on the user's Keeper account is used.

### Force Check in When Single-User Mode is enabled and a user has a record checked out, any approver configured on the record can force check in the resource. This immediately closes all active connections for the checked-out user and returns the record to an available state, allowing another user to check it out.

### Notifications

Required reason and ticket number for approval

### Notifications Approvers will receive a notification prompting them to approve or deny the request. If the request is approved, the record status is updated in the requester’s Vault, and the requester is then allowed to launch the connection.

## Workflow and Ephemeral Accounts and Privilege Elevation To achieve full Just-In-Time access and Zero Standing Privilege, combine Workflow with ephemeral accounts and privilege elevation. Together, these features ensure that access is time-bound, approved, and uses temporary credentials and elevated permissions that are automatically removed when the session ends — leaving no persistent access behind. To get started, visit: [Direct Ephemeral Accounts and Privilege Elevation](/keeperpam/privileged-access-manager/just-in-time-access-jit/ephemeral-accounts-and-privilege-elevation.md) If multiple approvers are configured, access is granted according to the approval policy defined for that resource, requiring either a single approver or a specified number of approvers before access is unlocked. After the session ends or the access window expires, credentials are automatically rotated, eliminating any residual exposure and ensuring Zero Standing Privileges are consistently enforced across every resource in your environment. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.keeper.io/keeperpam/privileged-access-manager/just-in-time-access-jit/workflow.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.