🛠️ Admin guide
This guide is for people who manage a Sneakers-PAM site: folder owners who decide who sees what, and site admins who run the whole install. It assumes you're already signed in — see the user guide if you need the basics of signing in and using a secret first.
🗂️ Running the site
- 📁 Folders and permissions: how secrets and folders fit together, and who can see, reveal, approve or just hear about each one.
- 🧩 Secret types: every built-in type, its fields, and which of them support a heartbeat, rotation or check-out.
- 🔌 Targets and connections: linking a secret to the system it actually protects, so Sneakers-PAM can check and change it there.
- 🔄 Heartbeat and rotation: keeping a secret's value in sync with its target, on a schedule or on demand.
- ✅ Approvals and requests: who approves a reveal, when nobody else can, and how one task gets one prompt.
- 🔐 Security settings: the site-wide switches for super-sensitive fields, MFA on checkout and on reveal, top-level folders, and session limits.
- 🚨 Break-glass: the emergency path outside the planned approvals, for people only — agents and tokens can't use it.
- 📜 Audit trail: the hash-chained log every sensitive action lands in.
- 🤖 MCP and agent tokens: turning on the MCP server and issuing tokens for agents and automation.
🧭 Who does what
| Role | What it adds |
|---|---|
| Anyone with access | Read, reveal and use whatever a folder's rules give them |
| A folder owner | Also approves requests for that folder's secrets, and authors (creates, edits) in it |
| A designated approver | Approves requests for the specific secrets a folder's rules name them on, without owning the folder |
| A site admin | Reads every shared folder's secrets, manages secret types, shared targets, connections and security settings; is never an automatic approver or author |
A site admin's broad read access is for running the site, not for everyday use, and it stops at other people's personal folders: see break-glass for the one path that lets an admin reveal someone else's personal secrets, and why it's recorded the way it is.
📦 Looking after the box
If you also run the appliance itself — the signed operating system Sneakers-PAM ships on — see the appliance admin guide for install, updates, backups and troubleshooting. That's a separate job from running the site above: an appliance admin manages the box, never the secrets in it.