Passwords stored in encrypted vaults, checked out when needed - **Session recording** — All privileged sessions recorded for audit - **Just-in-time access** — Privileges granted only when needed, automatically revoked - **Automatic rotation** — Passwords changed after every use or on a schedule - **