5.2 Safe Permissions, Authorizations & Safe Handler Delegation
Key Takeaways
- The critical distinction between Use accounts and Retrieve accounts enforces zero-knowledge administration: Use accounts injects credentials via PSM without revealing cleartext, whereas Retrieve accounts displays the plaintext secret.
- Initiating manual CPM operations (Verify, Change, Reconcile) requires the Initiate CPM password management operations permission on the user, but the assigned CPM service identity must possess full content update rights.
- Administrative delegation is achieved by granting Manage Safe Members and Update account properties to local Safe Handlers without granting full Manage Safe or Retrieve accounts privileges.
- Multi-tier Dual Control workflows require separate Authorize password requests (Level 1) and Authorize password requests (Level 2) permissions assigned to distinct supervisory groups.
- Standardized role templates mapped to Active Directory groups ensure that end users, auditors, operators, and service accounts adhere strictly to the principle of least privilege.
5.2 Safe Permissions, Authorizations & Safe Handler Delegation
Quick Answer: CyberArk enforces granular Safe access controls through individual authorizations assigned to directory users and groups. The most critical security distinction on the PAM-DEF exam is between Use accounts (which permits users to launch transparent, proxied sessions via PSM/PSMP without viewing the plaintext secret) and Retrieve accounts (which permits viewing or copying the cleartext password). Enterprise governance relies on standardized role templates (Consumer, Auditor, Operator, Safe Handler) and the Delegated Safe Handler model, allowing departmental managers to govern Safe membership without holding full Vault administrative privileges.
Granular Safe Authorizations Catalog
When adding a member (user or group) to a Safe in the Password Vault Web Access (PVWA) or PrivateArk Client, administrators configure granular authorizations governing container and credential interactions.
Credential Access & Session Authorizations
- Use accounts: Authorizes consuming credentials to initiate transparent sessions via Privileged Session Manager (PSM) or PSMP. The Vault transmits secrets directly to PSM memory; users never see, copy, or know the plaintext password.
- Retrieve accounts: Authorizes viewing the plaintext password on screen ("Show Password") or copying it ("Copy Password") in PVWA, and downloading stored files. This is a high-risk operation logging audit event Code 295.
- List accounts: Permits viewing account metadata (Name, Address, Platform, Status) in PVWA grids. Users lacking "List accounts" cannot browse or select accounts in the web portal.
Account Modification & Management Authorizations
- Add accounts: Authorizes onboarding new account objects or uploading files into the Safe.
- Update account content: Authorizes modifying the secret payload (password or SSH key) of an existing object, executed manually by users or programmatically by CPM.
- Update account properties: Authorizes editing account metadata categories (Address, Username, Port, custom tags) without altering the password value.
- Specify next password value: Allows a user to dictate the exact string applied during the next CPM password change operation, overriding automatic random password generation.
- Delete accounts: Permits moving accounts to the soft-deleted state within the Safe, subject to retention rules.
- Unlock accounts: Authorizes releasing accounts locked due to active user checkout or locked by CPM during an active rotation task.
Operational & Policy Authorizations
- Initiate CPM password management operations: Grants users authority to manually trigger ad-hoc CPM tasks from PVWA ("Verify", "Change", and "Reconcile").
- Manage Safe: Authorizes modifying Safe container properties, including renaming the Safe, adjusting retention periods, modifying storage quotas, and reassigning the managing CPM instance.
- Manage Safe Members: Grants permission to add new users/groups to the Safe, remove members, and adjust their assigned authorization bits.
- View Audit: Authorizes inspecting the Safe activity log and account history tabs, exposing timestamps, client IP addresses, and user actions.
- Authorize password requests (Level 1 & Level 2): Grants authority to review, approve, or reject Dual Control access requests across single or multi-tier approval chains.
The Core Privilege Distinction: "Use" vs. "Retrieve"
The architectural separation between "Use accounts" and "Retrieve accounts" is foundational to CyberArk's zero-trust security model:
- "Use accounts" (Zero-Knowledge Access): The user clicks "Connect" in PVWA. The Vault transmits credentials directly to PSM memory over TCP port 1858, which injects them into the session stream. Users never view or copy cleartext credentials, eliminating risks from client keyloggers and credential sharing.
- "Retrieve accounts" (Cleartext Disclosure): The user clicks "Show" or "Copy" in PVWA, sending the plaintext secret to the browser and generating Audit Code 295. Standard administrators should never receive this right; it is reserved for break-glass emergency roles with mandatory Dual Control.
CPM Service Account Authorizations
For the Central Policy Manager (CPM) to manage credentials within a Safe, its service identity (e.g., PasswordManager) must be enrolled as a Safe member with explicit rights:
| Authorization Required by CPM | Operational Necessity |
|---|---|
| List accounts | Allows CPM to discover managed accounts during periodic polling loops. |
| Retrieve accounts | Required during Verify and Change tasks to read the existing secret. |
| Update account content | Required to write the new password or SSH key to the Vault after target rotation. |
| Update account properties | Required to update status attributes (LastTask, LastSuccessVerification, error codes). |
| Unlock accounts | Required to release operational locks once background tasks complete. |
| Initiate CPM operations | Allows CPM to self-queue automatic retries and reconciliation workflows. |
Critical Troubleshooting Scenario: If CPM successfully connects to a target host and updates the password, but the operation finishes with an error leaving the account locked in PVWA, the CPM user is missing Update account content. CPM changed the target password, but the Vault rejected writing the new secret into the Safe object.
Standard Enterprise Role Templates
To ensure consistent governance, organizations define standardized role templates mapped to Active Directory security groups rather than assigning individual user accounts.
| Authorization Bit | End User (PSM) | Operator (L1/L2) | Break-Glass | Safe Handler | Auditor | CPM Engine |
|---|---|---|---|---|---|---|
| List accounts | Yes | Yes | Yes | Yes | Yes | Yes |
| Use accounts | Yes | Yes | Yes | No | No | No |
| Retrieve accounts | No | No | Yes | No | No | Yes |
| Add accounts | No | No | No | Yes | No | No |
| Update account content | No | No | No | No | No | Yes |
| Update account props | No | No | No | Yes | No | Yes |
| Initiate CPM tasks | No | Yes | No | Yes | No | Yes |
| Unlock accounts | No | Yes | Yes | Yes | No | Yes |
| Manage Safe Members | No | No | No | Yes | No | No |
| Manage Safe | No | No | No | No | No | No |
| View Audit | No | Yes | Yes | Yes | Yes | Yes |
| Authorize Requests | No | No | No | Optional | No | No |
The Delegated Safe Handler Model
In large enterprises with hundreds of application teams, centralizing all account onboarding and access requests within a single PAM team creates severe operational bottlenecks. The Delegated Safe Handler model decentralizes day-to-day administration without compromising security.
- Separation of Infrastructure from Content: Central PAM engineers maintain core infrastructure (Vault, CPM, PSM, PVWA, platforms), creating Safes, setting quotas, configuring retention, and assigning the CPM.
- Delegated Administration: Departmental leads receive the Safe Handler role on their Safes, granting Manage Safe Members, Add accounts, and Update account properties.
- Privilege Guardrails: Safe Handlers must never receive Manage Safe (preventing retention or quota alterations) and should not possess Retrieve accounts unless strictly required.
- Comprehensive Auditing: Every member modification executed by a Safe Handler logs Audit Code 308 to the SIEM.
An organization requires system administrators to connect to critical production Linux servers via PSM for SSH without ever seeing, copying, or knowing the actual root password. Which minimal Safe permissions must be granted to the administrator group?
A Central Policy Manager (CPM) successfully changes a password on an Active Directory domain controller, but the operation ends in an error status inside the Vault, leaving the account locked. A Vault audit reveals that the CPM service account could not write the newly generated password to the Vault object. Which Safe permission is missing from the CPM service account?
In an enterprise implementing the Delegated Safe Handler model, a departmental application manager needs to add and remove team members from their application's Safe without having the ability to view cleartext credentials or alter the Safe's CPM assignment and retention rules. Which Safe authorizations should be assigned to this departmental manager?