# Getting started

> What a company needs to use Ironchip privileged access, which permissions each area of the console grants and in what order to configure it all.

URL: https://docs.ironchip.com/en/pam/administracion/primeros-pasos/

This page explains what you need to start using Ironchip PAM, which console permissions each administrator needs and in what order everything is configured. It is for whoever sets up privileged access in a company.

## The plan

Privileged access is part of the company's plan. If it is not included, the **PAM** pages show `Privileged access is not part of your company's plan` with the **Go to billing** button. To add it, go to billing or write to sales@ironchip.com.

**PAM > Approvals** and **Authentication policies > Approval policies** work without the plan, because approvals also serve single sign-on applications.

## Permissions

Each PAM area has its own resource in **Security > Permissions**, so you can split administration between teams. See [Roles and permissions](https://docs.ironchip.com/en/identidad/administracion/permisos/).

| Permission resource                    | What it allows                                                                                            |
| -------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| **PAM targets, sites and agents**      | Sites, resources, their accounts, their rotation, agents, account inventory, exposure and target policies |
| **PAM control and password policies**  | Control policies and the company's password complexity                                                    |
| **PAM directory**                      | Directory for domain accounts                                                                             |
| **PAM secrets**                        | The company's secrets                                                                                     |
| **PAM workloads**                      | Workloads that read the secrets                                                                           |
| **PAM cloud accounts and credentials** | AWS, Google Cloud and Azure accounts, and temporary credential roles                                      |
| **PAM break-glass and checkouts**      | Who can break the glass and the record of passwords handed over                                           |
| **PAM approvals and sessions**         | See all requests and decide them (Update), see sessions in progress (Read) and end them (Delete)          |
| **PAM recordings and live view**       | Watch recordings and live sessions                                                                        |

People who only request access and connect need no permission: being in an access's group is enough. [Team passwords](https://docs.ironchip.com/en/pam/boveda/contrasenas/) need no permission either.

## Configuration order

1. **[Sites](https://docs.ironchip.com/en/pam/administracion/sitios/).** Where the machines are.
2. **[Resources](https://docs.ironchip.com/en/pam/administracion/recursos/).** Each server, desktop, database or cluster, with the account the broker signs in with.
3. **[Target policies](https://docs.ironchip.com/en/pam/administracion/politicas/#target-policies).** Named sets of resources, such as `Production Linux`.
4. **[Control policies](https://docs.ironchip.com/en/pam/administracion/politicas/#control-policies)** (optional). Which `sudo` commands and which Windows programs are allowed, rejected or wait for approval.
5. **[Approval policies](https://docs.ironchip.com/en/pam/administracion/aprobadores/)** (optional). Who approves, how many people and how long the window lasts.
6. **[Accesses](https://docs.ironchip.com/en/pam/administracion/accesos/).** In **Integrations**, a **Privileged access** integration with one access per group: which target policies it reaches, what it can do and with which factors and approvals.
7. **[Agent](https://docs.ironchip.com/en/pam/administracion/agente/)** (optional). On the machines where you want to control `sudo` or Windows programs, rotate local accounts or see each session's processes.

After that, the people in the group can [request access](https://docs.ironchip.com/en/pam/usuarios/solicitar-acceso/) and [connect](https://docs.ironchip.com/en/pam/usuarios/conectarse/).

## PAM menu

| Menu                            | What it is for                                                                                      |
| ------------------------------- | --------------------------------------------------------------------------------------------------- |
| **Hosts > Sites**               | [Sites](https://docs.ironchip.com/en/pam/administracion/sitios/)                                                             |
| **Hosts > Targets**             | [Resources](https://docs.ironchip.com/en/pam/administracion/recursos/)                                                       |
| **Hosts > Accounts**            | [Accounts](https://docs.ironchip.com/en/pam/administracion/cuentas/) that the agents find on the machines                    |
| **Hosts > Target policies**     | [Target policies](https://docs.ironchip.com/en/pam/administracion/politicas/#target-policies)                                |
| **Hosts > Control policies**    | [Control policies](https://docs.ironchip.com/en/pam/administracion/politicas/#control-policies)                              |
| **Hosts > Password complexity** | [Password complexity](https://docs.ironchip.com/en/pam/boveda/rotacion/#password-complexity)                                 |
| **Hosts > Directory**           | [Directory](https://docs.ironchip.com/en/pam/administracion/directorio/)                                                     |
| **Hosts > Exposure**            | [Exposure](https://docs.ironchip.com/en/pam/administracion/exposicion/): ways in that bypass Ironchip                        |
| **Secrets > Secrets**           | [Secrets for applications](https://docs.ironchip.com/en/pam/boveda/secretos/)                                                |
| **Secrets > Workloads**         | [Workloads](https://docs.ironchip.com/en/pam/boveda/secretos/#add-a-workload)                                                |
| **Secrets > Credentials**       | [Short-lived credentials](https://docs.ironchip.com/en/pam/boveda/credenciales-temporales/)                                  |
| **Approvals**                   | [Requests and commands waiting for approval](https://docs.ironchip.com/en/pam/administracion/aprobadores/#deciding-requests) |
| **Checkouts**                   | [Checkouts and break-glass](https://docs.ironchip.com/en/pam/boveda/checkouts/)                                              |
| **My access**                   | [Request access](https://docs.ironchip.com/en/pam/usuarios/solicitar-acceso/) and [connect](https://docs.ironchip.com/en/pam/usuarios/conectarse/)    |
| **Passwords**                   | [Team passwords](https://docs.ironchip.com/en/pam/boveda/contrasenas/)                                                       |
| **Sessions** and **Recordings** | [Sessions and recordings](https://docs.ironchip.com/en/pam/administracion/sesiones/)                                         |