Short answers to questions administrators and users ask most. Each answer links to the page with the details.
Access and sessions
A request is approved, but the user still cannot connect. Why?
Approval does not grant access the policies do not allow. The user also needs a Resource Access Policy for the resource and a Space Access Policy for its space. See Approve and revoke access.
A request stays at Waiting for Service. Who decides it?
No approver is named in the policy workflow or the resource's approval settings. Add approvers; a super administrator can decide the waiting request with Decide.
Can a session move to another gateway if its gateway fails?
No. Sessions are not migrated. New sessions go to another gateway within a minute when a second gateway serves the same connection types. See Recovery objectives (RTO and RPO).
Is there a maximum session length?
Sessions end after the idle timeout (15 minutes by default) and at the end of an approval window. Use approval windows if you need an absolute limit.
Can users connect with their own clients instead of the browser?
Yes: the SSH bastion for SSH clients, the RDP desktop client, the Database Proxy for database clients and kubectl or oc for Kubernetes. See Connect with a client.
Credentials and secrets
Do users ever see the password of the account they connect with?
No, unless a Vault Access Policy lets them reveal it. Brokered sessions, the Database Proxy, the SSH bastion and Kubernetes access inject the credential on the gateway.
What is the difference between the Vault and Secrets?
The Vault holds privileged account credentials used for sessions and rotation. Secrets holds application configuration and keys read by programs through machine identities, the CLI, syncs and the Vault-compatible API.
Can HashiCorp Vault clients read Monopam?
Yes, read-only, once the Vault-compatible API is turned on under System → Secrets API. See Vault-compatible API.
What happens if the vault encryption key is lost?
Data encrypted with that key cannot be recovered. Keep the key in a secret store with a backup. See Vault encryption key.
Recording and audit
Are all sessions recorded?
Recording follows the policy and the resource settings. Sessions of external users are always recorded. Database sessions are recorded statement by statement, not as video.
Can I export the audit log?
Yes, from Audits, and you can subscribe to scheduled audit reports. See Audit log.
Platform
Can the application tier run active-active?
Not in this release. Plan fast restart or replacement for the application tier and redundant gateways.
Which databases does the Database Proxy support?
PostgreSQL, MySQL, Microsoft SQL Server, Oracle, IBM Db2, Sybase ASE and SAP HANA.
Can AI agents use Monopam?
Yes, through the MCP Server, with the caller's own permissions and full audit. It is off by default. See MCP Server for AI agents.