Master Policy and its exceptions
The seven organisation-wide privileged access controls, how a safe or platform exception can loosen one of them without changing your baseline, and the one exception scope that is accepted but not yet honoured.
Master Policy is a name for something you already have: it is your organisation-wide PAM policy row itself, carrying seven specific controls, rather than a separate object you have to go create. Manage it from Privileged → Policies, /pam/policies, under "Master Policy controls."
The seven controls
| Control | What it does |
|---|---|
| Reason | Requires a reason to be supplied before access is granted. |
| Ticket | Requires a validated ticket reference before an access request can even be created — see Ticket validation for access requests. |
| Exclusive | Takes an automatic, session-bound checkout hold so only one person can use a credential at a time — see Exclusive checkout and check-in. |
| One-time | Rotates the credential automatically once the session ends, so the value used is never reused. Requires a rotation schedule already configured on the credential — if there isn't one, the rotation attempt is recorded as a failed outcome rather than silently skipped, and that gap is what the rotation-compliance report surfaces. |
| Live monitor | Allows a session against this safe to be watched live — see Live session monitoring. |
| No clipboard | Blocks clipboard data from crossing an RDP session in either direction. |
| No drives | Blocks drive redirection on an RDP session — nothing from a locally mapped drive crosses into the session. |
Each is an on/off checkbox on the base policy form — leaving one unticked never silently ships as an enforced "off"; only what you explicitly touch is changed on save.
Exceptions: loosening one control for a single safe or platform
An exception overrides one or more Master Policy controls for a single safe or a single platform, without changing the organisation-wide default anywhere else. This is the mechanism for "this one safe genuinely needs less restriction than the org baseline" — a break-glass safe that should not require a ticket, for instance — which an ordinary policy merge cannot express, because normal PAM policy merging only ever tightens (the shortest duration wins, recording is required if any applicable policy asks for it). An exception is a deliberately separate resolution path.
Each of the seven controls in an exception is three-valued, not a checkbox: Inherit organisation default, On, or Off. Leaving a control on Inherit keeps whatever the org baseline says for it; only the ones you explicitly set to On or Off change for that safe or platform.
What to read next
- PAM access policies — the general PAM policy model Master Policy is part of.
- Reconciling a drifted credential — relevant if the One-time control's rotation schedule ever falls behind.