A PAM role grants access to resources by label plus a session policy (recording, join, approval, max duration). A binding attaches one or more roles to a user, group, or SSO claim.

​
Role shape

apiVersion: resources.tigeraccess.dev/v1alpha1
kind: TigerAccessRole
metadata:
  name: prod-sre
spec:
  # WHAT this role can access
  allow:
    ssh:
      labels: { env: prod, tier: web }
      logins: [alice, deploy]
    kubernetes:
      labels: { env: prod }
      groups: [system:masters]
    database:
      labels: { engine: postgres, env: prod }
      names: [prod-postgres]
      users: [read_only, read_write]

  # HOW the session is governed
  options:
    session_ttl: 4h
    max_session_ttl: 8h
    record_session: true
    allow_agent_forwarding: false
    require_approval_for: [ssh, database]  # elevation via access request
    lock_on_disconnect: true

​
Bindings

tash-admin bindings create \
  --role=prod-sre \
  --user=alice@example.com \
  --ttl=90d

# Group binding via SSO claim
tash-admin bindings create \
  --role=prod-sre \
  --sso-claim=groups=platform-oncall
Group bindings are dynamic — users acquire the role at login based on their claims. Direct user bindings expire on ttl.

​
GitOps

If you deployed the PAM Kubernetes operator, define roles as CRDs: 
kubectl apply -f - <<'YAML'
apiVersion: resources.tigeraccess.dev/v1alpha1
kind: TigerAccessRole
metadata: { name: prod-sre }
spec: { ... }
YAML
The operator reconciles against the backend.

Resources

Labels are how roles match resources.

Access requests

Time-boxed elevation for privileged roles.