Every tash ssh, tash kube, tash db, and tash rdp opens a session. Sessions are recorded on the PAM server, encrypted before landing in object storage, and indexed for playback.

​
Session lifecycle

tash ssh alice@web-01
   │
   ▼
tigeraccess-server allocates a session id
   │
   ├─► mints short-lived cert (mTLS to the resource)
   │
   ├─► opens SSH channel to web-01 via the node agent
   │
   ├─► recorder captures stdin, stdout, and PTY resize events
   │
   ├─► session events streamed to the audit bus
   │
   ▼
On exit:
   ├─► recording finalized (asciicast v2 for tty, MP4 for RDP)
   ├─► SM transit-encrypted
   ├─► uploaded to S3
   └─► indexed for search

​
Recording formats

Session kindFormat
ssh, kubernetesasciicast v2 (JSONL) — small, searchable
rdpMP4 (H.264)
databaseSQL statement log (\d-style, full query text)
http_appHTTP transaction log (request + status + response summary)
Recordings are stored in the workspace’s S3 bucket (or MinIO in dev). They are encrypted at rest with a per-recording key, wrapped by SM’s transit engine — nothing readable escapes S3 without the platform.

​
Playback

PAM → Sessions → <session-id> → Play. Speed control (0.5×–8×), keystroke search, and shareable timestamp links.

​
Live join

Sessions marked join: allowed in the role can be joined mid-flight: 
tash-admin sessions ls --active
tash-admin sessions join sess_xxx --mode=moderator   # observe + kill
tash-admin sessions join sess_xxx --mode=peer         # co-drive
Every join is itself a session and gets its own audit row.

Roles

Session policy — record, join, approval, TTL.

Access requests

Elevation flow that gates sensitive sessions.