> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PAM session lifecycle

> Learn what happens from the moment someone connects to an account until the session ends.

A session starts when a person or [AI agent](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview.md) connects to an [account](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md), and ends when they disconnect. This page describes each stage, from the checks Infisical runs before the session starts to the records it keeps afterward.

## Before the session starts

Infisical checks the following before it starts a session:

1. The person has a [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the account or its folder that lets them launch sessions
2. The person gives a reason, if the [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md) requires one
3. The person completes MFA, if the template requires it
4. An approver has approved the person's [access request](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md), if the template requires approval

AI agents go through the same checks. An agent can't answer a prompt, so you pass the reason with `--reason` when you start the agent, and the agent can't use accounts that require MFA. To learn more, see [Run an agent](https://infisical.com/docs/documentation/platform/pam/ai-agents/run.md).

## Connecting

The connection runs through a [gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) on your network. The gateway connects to the database or server with the account's credential, so the credential never reaches the person's browser or machine. For each step of the connection, see [Architecture](https://infisical.com/docs/documentation/platform/pam/architecture.md#how-a-connection-works).

What the person sees depends on the account type and on whether they connect in the browser or with the CLI. To learn how to connect each way, see [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md).

## During the session

Infisical [records](https://infisical.com/docs/documentation/platform/pam/sessions/session-recording.md) the queries or commands that the person runs. Admins and Auditors on the account can review the recording while the session is still active.

## Ending the session

The session ends when one of the following happens:

* The person disconnects
* The session reaches the template's maximum session length
* An Admin on the account [terminates the session](https://infisical.com/docs/documentation/platform/pam/sessions/overview)

## After the session

Infisical keeps the following records of each session:

* **Recording**: Admins and Auditors on the account can review it on the [Sessions](https://infisical.com/docs/documentation/platform/pam/sessions/overview) page
* **Audit log**: The [audit log](https://infisical.com/docs/documentation/platform/pam/auditing.md) has events for the session, such as **Start PAM Session** and **End PAM Session**

## Next steps

> [card] [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md)
>
> Open a session on an account from your browser or the Infisical CLI.

> [card] [Session recording](https://infisical.com/docs/documentation/platform/pam/sessions/session-recording.md)
>
> Review what happened during each session on your accounts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.