Agree on the scenarios with the customer at the start, and record each result against its success criterion. Each scenario lists what it needs, how to run it and what counts as success.
1. Recorded privileged session
|
|
|
|---|---|
|
Prerequisites |
A test server, a vault item, a Resource Access Policy with recording. |
|
Steps |
Connect as a PoC user from the browser, run a few commands, disconnect. |
|
Success when |
The user never saw the password; the recording plays back with a searchable transcript; the audit log shows connect and disconnect. |
2. Approval before access
|
|
|
|---|---|
|
Prerequisites |
A Request Policy or approval on the resource; an approver account. |
|
Steps |
The user requests access with a reason; the approver approves; the user connects; the approver revokes. |
|
Success when |
Access opens only after approval and ends immediately on revoke. |
3. Command control
|
|
|
|---|---|
|
Prerequisites |
A Privileged Command rule that blocks or requires approval for a command (for example |
|
Steps |
Run the command in an SSH session. |
|
Success when |
The command is blocked or waits for approval; the decision is in Requests and the audit log. |
4. Password rotation
|
|
|
|---|---|
|
Prerequisites |
A Password Rotation Policy on the test account. |
|
Steps |
Rotate now; connect again. |
|
Success when |
The password changed on the target; the connection still works without anyone knowing the new password. |
5. Database access through the Database Proxy
|
|
|
|---|---|
|
Prerequisites |
A test database (PostgreSQL, MySQL, MSSQL, Oracle and others) and Database Rules. |
|
Steps |
Connect with the SQL console and with a native client; run a SELECT, an UPDATE without WHERE, and a query on a masked column. |
|
Success when |
Statements are audited one by one; the unsafe UPDATE is blocked or sent for approval; sensitive columns are masked. |
6. Discovery
|
|
|
|---|---|
|
Prerequisites |
A Discovery Policy for a directory or network range. |
|
Steps |
Run the policy; review Discovered Accounts; import one privileged account. |
|
Success when |
Privileged accounts are found and listed with the reason; the imported account is vaulted and rotated. |
7. Certificate lifecycle
|
|
|
|---|---|
|
Prerequisites |
An issuer (private CA or ACME) and a deployment target. |
|
Steps |
Request a certificate, deploy it, and look at the expiry overview. |
|
Success when |
The certificate is issued, deployed and tracked; expiry alerts are configured. |
8. Application secrets
|
|
|
|---|---|
|
Prerequisites |
A Secrets project and a machine identity. |
|
Steps |
Store a secret; read it with the |
|
Success when |
The program gets the value without a hard-coded secret; the read is audited. |
9. Vendor access
|
|
|
|---|---|
|
Prerequisites |
A vendor with an external user invitation. |
|
Steps |
Invite, approve, enroll, connect within the window; let the window expire. |
|
Success when |
The vendor works only within the window; the session is recorded; access ends automatically. |
10. Endpoint privilege management
|
|
|
|---|---|
|
Prerequisites |
The agent on a Windows or Linux endpoint and an endpoint policy. |
|
Steps |
Start a blocked application and an application that needs approval. |
|
Success when |
The blocked application does not start; the other runs after approval; both are in EPM audit. |