Keeper Security Adds Approval Workflow Controls To KeeperPAM Platform

Keeper Security has released a new workflow capability within its KeeperPAM platform, giving administrators approval-based controls for privileged access across their organisations.

The feature, called Keeper Workflow, is designed to enforce structured oversight over how privileged access is requested, approved and used within enterprise environments.

It arrives as organisations grapple with the growing presence of AI agents operating alongside human users inside corporate infrastructure, each representing a distinct identity that needs to be managed and secured.

Governing access in the age of AI agents

Darren Guccione, CEO and Co-Founder of Keeper Security, pointed to the shifting role of AI within enterprise technology stacks as a key driver behind the release.

“AI is no longer just a productivity tool; it is a permanent and foundational layer of the modern enterprise technology stack,” Guccione stated.

“With Keeper Workflow, we are enforcing the boundaries of AI and human access. This is zero trust in practice: structured, auditable and built to determine exactly when and if an identity is allowed to act inside the enterprise infrastructure.”

The company argues that as AI agents move from experimental tools to embedded enterprise infrastructure, each one introduces a new attack surface and compliance obligation that organisations must account for.

Keeper Workflow is intended to help organisations shift away from ad hoc privilege management toward a process that can scale while working toward zero standing privilege.

How the workflow operates

The new capability introduces several controls aimed at bringing consistency and accountability to privileged sessions.

At its core, the system requires administrator or designated approver sign-off before a user can establish a connection or tunnel to a privileged resource. Requests are managed through a centralised notification centre and can include multi-factor authentication requirements for establishing the connection after approval has been granted.

Users can submit access requests directly from the Keeper Vault or through the Keeper Commander CLI. Approvers can then receive notifications and approve or deny requests through the Keeper web vault, desktop app or mobile app.

Third-party integrations with Slack, Microsoft Teams, Jira and ServiceNow are also supported, allowing security teams to act on requests within their existing workflows without needing to switch platforms.

The system also supports single-user mode and time-limited enforcement, restricting access to a protected resource to one user at a time for a defined period. Once access is revoked, credentials can be automatically rotated, removing any standing privileges that might otherwise persist.

Targeting regulated industries

Keeper Workflow is aimed squarely at IT administrators and security teams in regulated industries such as financial services, healthcare and government, where manual oversight of privileged accounts is no longer practical at scale.

The company has outlined several use cases for the feature, including requiring formal approval before granting privileged access to compliance-governed systems, restricting servers or infrastructure resources to a single authorised user for a defined window of time and applying consistent access controls to systems where concurrent access poses organisational risk.

Craig Lurey, CTO and Co-Founder of Keeper Security, explained that the feature was built to maintain the company’s zero-knowledge architecture while introducing structured governance.

“Keeper Workflow was built to bring structured governance to privileged access without compromising our zero-knowledge architecture,” Lurey noted.

“Because it’s natively integrated within KeeperPAM, organisations can enforce approval-based access controls and eliminate standing privilege with a solution that is both easy to deploy and simple to operate at scale.”

A response to growing identity sprawl

The release reflects a broader industry trend in which organisations are contending with an expanding number of identities that require privileged access, driven not only by workforce growth but by the proliferation of automated systems and AI agents.

Each new identity represents a potential entry point that must be governed, and traditional approaches to privilege management are struggling to keep pace.

By embedding approval workflows directly into the PAM platform, Keeper is attempting to provide a single point of control that can handle both human and non-human identities under the same policy framework.

Keeper Workflow is available with the release of Vault 17.6 within KeeperPAM. Further details are available at KeeperSecurity.com.

Last Updated on May 13, 2026 by Nick Ross