# Just-in-Time sessions

> What an Ironchip Just-in-Time privileged session is: access granted only during the approved window, with no shared credentials and no open ports.

URL: https://docs.ironchip.com/en/pam/conceptos/sesiones-jit/

A Just-in-Time (JIT) session is privileged access that exists only for the length of an approved window. This page explains how it works and why, day to day, nobody needs to take a password out of the vault.

## Life of a session

1. **Request.** The person asks for access to a specific resource, with a reason if the policy requires one.
2. **Approval.** An approver accepts or rejects it, either once on request or on every connection, depending on the policy. See [Approval](https://docs.ironchip.com/en/pam/conceptos/aprobacion/).
3. **Open window.** A period of time opens during which the person can connect.
4. **Connection.** The person connects with a single-use ticket, from the console or with their own client. Before admitting them, Ironchip checks the address and the access factors, such as the device and the safe zone.
5. **Close.** The window closes automatically when it expires. The session is [recorded](https://docs.ironchip.com/en/pam/conceptos/grabacion/) and, if configured, the account password is changed.

## What the person sees and what they do not

The person never knows or types the privileged credential. The Ironchip PAM broker reads it from an encrypted store, injects it when opening the connection and hands it to nobody. That is why a vendor who finishes their work, or an employee who changes company, takes no password with them.

If the password is ever needed to use the machine without the broker, it is taken out with a [checkout](https://docs.ironchip.com/en/pam/boveda/checkouts/) or, in an emergency, with a break-glass, and it is rotated as soon as it is returned.

## Differences from a traditional vault

|                    | Traditional vault                             | Ironchip JIT session                                |
| ------------------ | --------------------------------------------- | --------------------------------------------------- |
| Credential         | The person obtains it by check-out            | The broker injects it; the person does not see it   |
| Privilege duration | Permanent or until the credential is returned | A window that closes automatically                  |
| Network access     | VPN or jump server                            | Outbound tunnel from your network, no inbound ports |
| Stolen login       | Gives access to the vault                     | Does not open without device, safe zone and factors |

## Next steps

- [Architecture](https://docs.ironchip.com/en/pam/conceptos/arquitectura/): which pieces take part in a connection.
- [Credential vault](https://docs.ironchip.com/en/pam/conceptos/boveda/): where credentials are stored and how they are rotated.
- [Request access](https://docs.ironchip.com/en/pam/usuarios/solicitar-acceso/): the flow for the person asking for the session.
- [Access policies](https://docs.ironchip.com/en/pam/administracion/politicas/): what each policy decides.