Mandate — Privileged Access Management Platform

Capabilities

Enterprise Privilege Management,
Rebuilt From First Principles

Every feature maps to a real operational need. Every permission boundary is enforced at the kernel level.

Identity Delegation Engine

Execute any command as any authorized user with -u USER. Seamlessly assume target identities without credential sharing — full impersonation with complete audit trails.

-u user

Group Vector Control

Override primary group context with -g GROUP. Fine-grained group-level access boundaries let you execute with precisely scoped permissions — no over-provisioning.

-g group

Deep Shell Immersion™

Full login shell simulation with -i loads target user profiles, environment files, and resource configurations. Complete identity context — not just a permission flip.

-i (login shell)

Credential Cache Governance

Refresh sessions with -v, invalidate with -k, or purge all cached credentials with -K. Timestamp-based session control with configurable TTLs.

-v / -k / -K

Privilege Audit & Enumeration

List all authorized commands and privileges with -l. Complete visibility into what each identity can do, across every host. Verbose mode reveals the matching policy rules.

-l (list)

Zero-Interaction Mode

Non-interactive execution with -n and background processing with -b. Purpose-built for CI/CD pipelines, automation workflows, and headless infrastructure operations.

-n / -b

Secure File Editing

Edit privileged files without exposing a root shell using -e (sudoedit). Temporary copies, automatic rollback, symlink protection — built-in guardrails for sensitive file modification.

-e / sudoedit

Environment Preservation Layer

Carry forward environment variables with -E, set HOME to the target user with -H, or preserve the invoking user's group vector with -P. Total context control.

-E / -H / -P

Architecture

Four-Phase Privilege Mediation

Every privileged operation flows through our battle-tested governance pipeline.

Policy Evaluation

The security policy plugin evaluates the requesting identity against the configured ruleset. Mandate checks user membership, target identity, command path, host context, and timestamp validity — all in under 2ms.

Authentication Challenge

If the policy requires it, Mandate issues a credential challenge. Supports terminal-based password, graphical askpass helpers (-A), stdin piping (-S), and PAM integration. Configurable timeout with automatic session locking.

Execution Context Assembly

The runtime assembles the target execution environment: real and effective UIDs/GIDs, supplementary group vectors, environment variables, working directory, umask, and scheduling priority — all configured by policy.

Monitored Execution & Audit

A dedicated monitor process allocates a pseudo-terminal, manages signal relay (SIGINT, SIGTSTP, job control), captures I/O for logging, and reports exit status back through the audit plugin chain.

Governance

Policy Configuration Studio

Define who can do what, where, and how — with our visual policy editor powered by the Mandate rule engine.

# Mandate Policy Configuration
# /etc/mandate.conf

# User privilege specification
# user    host = (run_as) commands

# Developers can restart web services
%developers   ALL = (root) /usr/bin/systemctl restart nginx, \
                           /usr/bin/systemctl restart apache2, \
                           /usr/bin/systemctl status *

# Ops team has full command access with authentication
%ops          ALL = (ALL:ALL) ALL

# Deploy user — no password for deployment commands
deploy        ALL = (root) NOPASSWD: /usr/bin/apt-get update, \
                                     /usr/bin/apt-get install *, \
                                     /usr/bin/systemctl restart *

# Admin group — unrestricted access
%admin        ALL = (ALL:ALL) ALL

# Defaults
Defaults        timestamp_timeout=15
Defaults        log_output
Defaults        requiretty

Policy valid — 4 rules, 0 errors

Capability	Mandate	Competitor A	Competitor B
Multi-identity delegation	✓ Any user or group	Root only	Limited
Credential cache with TTL	✓ Configurable per-terminal	Session-based only	No caching
Non-interactive mode	✓ Full CI/CD support	Partial	✗
Secure file editing	✓ sudoedit with symlink protection	✗	✗
Plugin architecture	✓ Policy, audit, I/O	Limited	Monolithic
Environment preservation	✓ Selective or full	All or nothing	✗
I/O session recording	✓ Built-in	Third-party only	✗
LDAP policy backend	✓ Native	✗	Partial

In Action

See Mandate in the Wild

Execute as Root

Terminal — mandate session

developer@host:~$ mandate ls /root

[mandate] password for developer: ********

.bashrc .profile .ssh backups scripts

Run as Another User

Terminal — mandate session

admin@host:~$ mandate -u www-data ls /var/www/html

index.html style.css app.js images

Login Shell Immersion

Terminal — mandate session

ops@host:~$ mandate -i

[mandate] password for ops: ********

root@host:~# whoami

root

Privilege Enumeration

Terminal — mandate session

developer@host:~$ mandate -l

User developer may run the following commands on host:

(root) /usr/bin/systemctl restart nginx

(root) /usr/bin/systemctl restart apache2

(root) /usr/bin/systemctl status *

Plans

Pricing That Scales With Your Security Posture

Every tier includes full audit logging and SOC 2 compliance reporting.

Operator

$29/seat/mo

Single target identity (root)
Basic command execution
5-minute credential cache
Password authentication only
Terminal-scoped sessions
Standard audit log (7-day retention)

What Security Leaders Are Saying

★★★★★

"Before Mandate, our privilege management was a liability. Now we have full visibility into every identity transition across 4,000 servers. The audit log alone paid for the entire deployment in the first compliance cycle."

Lucas Kirkland CISO, NovaStar Financial

★★★★★

"The non-interactive mode transformed our CI/CD pipeline. We went from manual privilege requests to fully automated, policy-governed deployments. Our ship velocity increased 3x overnight."

Kira Tanaka VP of Platform Engineering, DataMesh

★★★★★

"The Policy Configuration Studio is a game-changer. We went from managing raw config files to visual, version-controlled policy definitions. Our auditors actually understand what we're doing now."

Vera Suresh Head of Compliance, Fortify Labs

★★★★★

"Credential cache governance with configurable TTLs gave us the security posture our board demanded without destroying developer velocity. The -k flag integration with our .logout scripts was chef's kiss."

Athena Vasquez Staff SRE, ScaleForge

FAQ

Frequently Asked Questions

Mandate supports configurable timeout policies. If no password is entered within the configured limit (default: 5 minutes), the session terminates gracefully. Use the askpass helper (-A) for graphical environments, or -S to read from stdin for automated workflows.

Yes. Mandate's policy engine lets you restrict commands on a per-user, per-host basis. Combined with the noexec functionality, you can prevent shell escapes from editors and other programs. However, if a user is granted arbitrary command execution, a root shell is inherently possible — which is why Mandate enforces least-privilege by default.

Absolutely. With our I/O logging plugin, every keystroke and screen output from privileged sessions is captured, timestamped, and stored immutably. Sessions can be replayed for forensic analysis or compliance audits. This is standard on Governance and Sovereign plans.

Yes, with a caveat. Environments that set the Linux "no new privileges" flag will prevent Mandate from operating, as the setuid bit is ignored. Most container orchestrators allow you to configure this flag. Check your container documentation to ensure the flag is not set when Mandate needs to run.

By default, Mandate caches credentials on a per-terminal basis for 5 minutes. This means authenticating in one terminal does not grant access in another — a critical isolation boundary. You can customize the timestamp_type and timestamp_timeout settings to tune this behavior for your security requirements.

Privileged Access.
Zero Compromise.

Enterprise Privilege Management,
Rebuilt From First Principles

Identity Delegation Engine

Group Vector Control

Deep Shell Immersion™

Credential Cache Governance

Privilege Audit & Enumeration

Zero-Interaction Mode

Secure File Editing

Environment Preservation Layer

Four-Phase Privilege Mediation

Policy Evaluation

Authentication Challenge

Execution Context Assembly

Monitored Execution & Audit

Privilege Escalation Visualizer

Policy Configuration Studio

Policy Rules

The Category-Defining Difference

Real-Time Audit Log

See Mandate in the Wild

Execute as Root

Run as Another User

Login Shell Immersion

Privilege Enumeration

Pricing That Scales With Your Security Posture

What Security Leaders Are Saying

Frequently Asked Questions

Coming Soon

Privileged Access.Zero Compromise.

Enterprise Privilege Management,Rebuilt From First Principles

Identity Delegation Engine

Group Vector Control

Deep Shell Immersion™

Credential Cache Governance

Privilege Audit & Enumeration

Zero-Interaction Mode

Secure File Editing

Environment Preservation Layer

Four-Phase Privilege Mediation

Policy Evaluation

Authentication Challenge

Execution Context Assembly

Monitored Execution & Audit

Privilege Escalation Visualizer

Policy Configuration Studio

Policy Rules

The Category-Defining Difference

Real-Time Audit Log

See Mandate in the Wild

Execute as Root

Run as Another User

Login Shell Immersion

Privilege Enumeration

Pricing That Scales With Your Security Posture

What Security Leaders Are Saying

Frequently Asked Questions

Privileged Access.
Zero Compromise.

Enterprise Privilege Management,
Rebuilt From First Principles