feat(pam): account policies

[saifsmailbox98]

Context

Adds account policies to PAM. Policies contain typed rules (command blocking, session log masking) that can be attached to accounts. When the gateway fetches session credentials, applicable rules are returned based on resource type.

Steps to verify the change

Type

• Fix
• Feature
• Improvement
• Breaking
• Docs
• Chore

Checklist

• Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
• Tested locally
• Updated docs (if needed)
• Updated CLAUDE.md files (if needed)
• Read the contributing guide_

[linear]

PAM-149 Support command blocking in PAM

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
infisical	🟢 Ready	View Preview	Apr 8, 2026, 12:51 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[maidul98]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[greptile-apps]

Greptile Summary

This PR introduces PAM account policies — a typed rule system (command blocking, session log masking) that can be attached to accounts and enforced when the gateway fetches session credentials. The implementation follows established PAM patterns: a new PamAccountPolicy table with a FK from PamAccount, a full CRUD service with project-scoped permissions, audit logging on all operations, and RE2-safe regex validation for rule patterns on the backend.

Confidence Score: 5/5

Safe to merge; all remaining findings are P2 style/naming suggestions that don't affect correctness or security.

All P0/P1 concerns (cross-project policy assignment, gateway auth, RE2 usage, migration idempotency) are handled correctly. The four inline comments are P2 style issues: void on a Knex mutation, generic permission action names, trigger/table drop ordering in down(), and a misleading function name. None of these affect runtime behavior.

No files require special attention.

Vulnerabilities

No significant security concerns identified. Cross-project policyId assignment is validated on both create and update paths in pam-account-service.ts. Regex patterns stored in policy rules are validated with RE2 on the backend (ReDoS-safe). The gateway credential endpoint correctly verifies gateway identity before returning policy rules. whereILike search is parameterized by Knex, preventing SQL injection.

Important Files Changed

Filename	Overview
backend/src/db/migrations/20260408014652_pam-account-policies.ts	Adds PamAccountPolicy table and policyId FK column on PamAccount; idempotent up(), but down() drops the table before dropping its trigger (harmless, but unconventional order).
backend/src/ee/services/pam-account-policy/pam-account-policy-dal.ts	Simple DAL wrapping ormify; findByProjectId uses void query.whereILike(...) which works but is misleading style.
backend/src/ee/services/pam-account-policy/pam-account-policy-service.ts	Full CRUD service with correct project-scoped permission checks and cross-project policy-ID validation on both create and update paths.
backend/src/ee/routes/v1/pam-account-policy-router.ts	REST router for policy CRUD with audit logging; sanitizePolicy is only a type cast despite the suggestive name.
backend/src/ee/services/pam-account-policy/pam-account-policy-schemas.ts	Uses RE2 for pattern validation (ReDoS-safe); correctly requires at least one rule via refine.
backend/src/ee/services/permission/project-permission.ts	Adds ProjectPermissionPamAccountPolicyActions with generic Read/Create/Edit/Delete names; consider more descriptive subject-specific names per project convention.
backend/src/ee/services/pam-account/pam-account-service.ts	Correctly validates policyId belongs to the same project on both create and update; getSessionCredentials filters rules by resource type using PAM_ACCOUNT_POLICY_RULE_SUPPORTED_RESOURCES.
backend/src/ee/routes/v1/pam-session-router.ts	Adds policyRules field to the session-credentials response; properly typed against PolicyRulesResponseSchema.

_{Reviews (1): Last reviewed commit: "docs: added documentation" | Re-trigger Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1db7b7f8f0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
29927633	Triggered	PostHog Project API Key	9298abe	docs/docs.json	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}