> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PAM account templates

> Set the rules for connecting to the accounts that use a template.

An account template sets the rules for connecting to the [accounts](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md) that use it, such as the maximum session length and whether access needs approval. It also sets which [gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) the accounts connect through and where Infisical stores their [session recordings](https://infisical.com/docs/documentation/platform/pam/sessions/session-recording.md).

Every account uses one template, and the template's account type must match the account's type. When you change a template, the change applies to every account that uses it.

## Default templates

Infisical creates a template for each account type when your organization first opens PAM. The default templates have no policies turned on, so sessions on their accounts last up to one hour, and Infisical stores the recordings in its internal database.

Windows and Windows AD accounts need recordings stored in AWS S3, so before anyone can launch sessions on them, change the default Windows templates to use [external storage](https://infisical.com/docs/documentation/platform/pam/sessions/external-storage.md).

If an account type has no template, such as a type added after your organization started using PAM, the **Account Templates** page shows a message. Select **Add default templates** in the message to create the missing templates.

## Create a template

Create your own template when some accounts need different rules, such as production databases that need approval before anyone connects.

**Step 1**

Go to **Privileged Access Management** > **Account Templates** and select **Create Template**.

**Step 2**

Enter a **Name**, choose the account **Type**, and optionally enter a **Description**, then select **Create Template**.

**Step 3**

On the template's **General** tab, set the [policies](#policies) and [system settings](#system-settings) that the accounts need.

**Step 4**

Select **Save Changes**.

To use the template, choose it when you [add an account](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md).

## Policies

| Policy | What it does |
| - | - |
| **Require Approval** | Users must request access, and an approver must approve the request, before they can launch a session or view the account's credentials (see [Access requests](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md)) |
| **Allow Auto-Approval** | Requests that pass one of the folder's rules are approved as soon as they're submitted (see [Auto-approval](https://infisical.com/docs/documentation/platform/pam/access-requests/auto-approval.md)) |
| **Allow Break-Glass** | Named responders can approve their own access requests in an emergency (see [Break-glass access](https://infisical.com/docs/documentation/platform/pam/access-requests/break-glass.md)) |
| **Require MFA** | Users must complete an MFA challenge before they connect |
| **Require Reason** | Users must give a reason before they connect |
| **Max Session Duration** | Infisical ends the session after this many seconds (60 to 86,400, or 900 to 3,600 for AWS IAM) |
| **Command Blocking** | Infisical rejects commands or SQL statements that match one of these regular expressions (SSH, Snowflake, and ClickHouse only) |

**Allow Auto-Approval** and **Allow Break-Glass** only work together with **Require Approval**. If you turn off **Require Approval**, Infisical also turns off **Allow Break-Glass**.

Machine identities and [AI agents](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview.md) can't complete an MFA challenge, so they can't connect to accounts whose template has **Require MFA** on. If an agent needs an account, use **Require Approval** instead.

## System settings

| Setting | What it does |
| - | - |
| **Gateway** | The gateway that the accounts connect through |
| **Storage backend** | Where Infisical stores session recordings: **Internal Database** or **S3 Bucket** (see [External storage](https://infisical.com/docs/documentation/platform/pam/sessions/external-storage.md)) |
| **Session Log Masking** | Hides text that matches these patterns in session recordings |

> [!NOTE]
>
> You can [override the gateway](https://infisical.com/docs/documentation/platform/pam/accounts/manage.md#override-the-template’s-settings) for one account on the account's **Advanced** tab. For Windows and Windows AD accounts, you can also override the recording bucket there.

The **General** tab also has settings for [credential rotation](https://infisical.com/docs/documentation/platform/pam/credential-rotation/overview.md) and [credential health](https://infisical.com/docs/documentation/platform/pam/credential-health/overview.md) checks, for account types that support them.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.