Reconciling a drifted credential

Reconcile fixes a credential whose actual value on the target no longer matches what the vault holds — someone changed the password by hand, a system was rebuilt from an older image, a failed rotation left things half-updated. Rather than trying to authenticate as the drifted account itself to fix it, reconcile authenticates as a separate, privileged reconcile account and uses it to reset the drifted one. Use the Reconcile row action on a credential in Privileged → Vault, /pam/vault.

Why a separate account, not the credential itself

If a credential's own stored value no longer works, using it to fix itself is circular — you would be authenticating with the very value you suspect is wrong. A reconcile account is a different, already-trusted identity capable of resetting the drifted one, the same way a domain admin account can reset a service account's password without needing that service account's current password.

It needs a rotation adapter already configured

The flow

1. 1

   Set a reconcile account (once)

   In the Reconcile dialog, supply the credential id of a different, already-vaulted, privileged account to use for resets. Copy the id from the vault table — this is not a searchable picker yet, just a credential id field.

2. 2

   Reconcile now

   With a reconcile account set, run "Reconcile now." The drifted credential's secret is reset through the configured adapter, using the reconcile account's authority, and the outcome (succeeded or failed) is shown inline. The row refreshes to reflect the new state.

If reconcile is attempted with no reconcile account set, the response is a clear, specific refusal naming the missing account — the console autofocuses the account field so the fix is obvious, rather than surfacing a generic validation error.

What to read next

1. Rotation adapters and platforms — every platform reconcile can act through, since it rides the same adapter a rotation schedule uses.
2. Master Policy and its exceptions — the One-time control, which shares the same "needs a rotation schedule configured" prerequisite.