Architecture / Access Control

Privileged Access Management on IBM i

Powerful profiles are necessary. Leaving them signed on indefinitely with no logging of what they did while elevated is the part that isn't.

Last verified August 19, 2026

The Problem With Standing Privilege

Most IBM i shops have a handful of profiles carrying *ALLOBJ, *SECADM, or *SERVICE special authority: QSECOFR itself, a small number of senior administrators, and often forgotten service accounts left over from a migration or integration project. The common failure mode is standing privilege: those profiles stay elevated all the time, rather than being elevated only when a specific task requires it, and there is no record of what was done while elevated.

What Privileged Access Management Adds

A dedicated privileged access management (PAM) product on IBM i, most notably Fortra's Powertech Authority Broker, lets administrators request temporary elevation to a specific special authority or profile swap, for a defined time window, with the request and every action taken while elevated logged. When the window expires, the elevation is automatically revoked rather than relying on someone remembering to sign off.

Standing Privilege vs. Managed Elevation

	Standing Privilege	Managed Elevation (PAM)
Duration of elevated access	Indefinite	Time-boxed, auto-revoked
Approval before elevation	None	Request/approval workflow
Logging of actions taken	Standard system audit journal only	Session-level activity log tied to the elevation request
Audit trail of who approved access	Not captured	Captured as part of the request record

Adopted Authority as a Lighter-Weight Alternative

For application-level elevation, IBM i's native adopted authority (programs that run under the authority of their owner rather than the calling user) lets you grant elevated access scoped to a specific program's function, without granting the special authority to the user's own profile at all. This is not a substitute for PAM on interactive administrative access, but it is the right tool for giving an application the authority it needs without widening a user's profile.

Implementation Priorities

Inventory Powerful Profiles First

Run an authority collection to find every profile with *ALLOBJ, *SECADM, or *SERVICE before deciding who genuinely needs standing access.

Start With the Highest-Risk Profiles

QSECOFR and any profile with *SECADM are the highest-value targets for managed elevation; start there, not with a full rollout.

Log to a SIEM, Not Just Locally

Forward elevation logs to your SIEM so privileged activity is reviewed alongside the rest of your security monitoring, not siloed on the IBM i box.

Vendors Covering This Control

Fortra (Powertech)

Fortra's Powertech line (formerly HelpSystems, formerly PowerTech Group) is the longest-running dedicated IBM i security vendor and still the largest install base by most industry surveys, including its own annual State of IBM i Security Study. Powertech Multi-Factor Authentication, Authority Broker, Exit Point Manager, and Compliance Monitor are each strong standalone products.

Strengths

Largest install base among dedicated IBM i security vendors, with the deepest bench of IBM i-specific security expertise
Powertech Authority Broker is a mature, well-regarded privileged access / elevated-authority management product
Exit Point Manager provides granular network access control across FTP, ODBC, DDM, and remote command exit points
Publishes the annual State of IBM i Security Study, a widely cited independent-feeling data source (though vendor-funded)

Limitations

Product line grew through acquisition (PowerTech, Bytware, Robot, Vityl) and integration between modules is less unified than Precisely's single suite
Some legacy product UIs (Robot Console-adjacent tooling) show their age relative to newer competitors
Full stack pricing across MFA, Authority Broker, Exit Point Manager, and Compliance Monitor adds up for smaller shops

Best fit: Shops that specifically need best-in-class privileged access management (Authority Broker) or exit-point network control, and are comfortable managing several point products rather than one suite.

Precisely (Assure Security)

Precisely's Assure Security suite is the broadest single-vendor IBM i security platform on the market, spanning multi-factor authentication, encryption, compliance monitoring, and access control in one licensing family. It is the platform we point mid-size and enterprise IBM i shops to first when they need one vendor covering the most ground.

Strengths

Widest single-suite coverage: MFA, encryption, exit point control, and compliance monitoring under one console
Strong native IBM i journal-based monitoring with real-time SIEM forwarding (Splunk, QRadar, Sentinel)
Assure Encryption supports field-level and full-database encryption without application changes in most cases
Established install base and long IBM i-specific engineering history (originated from Townsend Security and Syncsort lineage)

Limitations

Suite pricing and licensing complexity increases as modules are added; full-suite cost is not the cheapest entry point
MFA client coverage for legacy green-screen sessions requires exit-point configuration that takes real implementation time
Reporting UI is functional but less modern than some newer point-solution dashboards

Best fit: Mid-size to enterprise IBM i shops that want one vendor for MFA, encryption, and compliance monitoring rather than stitching together point products.