How Runtime
Authorization Works.
Getting privileged access right takes three things. Just-in-time grants, credentials that never touch the requester, and an experience good enough that people don’t work around it.
HOW IT WORKS
Every request to a database, container, or cloud infrastructure moves through the same four steps, no matter who or what is asking.
Someone requests access to one resource for one task. Policy approves it in seconds, or routes it to a human when the risk warrants review.
The user, machine, or agent connects through StrongDM, the only path to the resource.
StrongDM logs every action live, brokers the credential throughout, and ends the session the moment something violates policy.
Once the work finishes, access disappears automatically, so no credentials or open sessions linger.
.webp)
WHERE IT WORKS
Databases, containers, and infrastructure, in the cloud or on-premises, all reachable through the same StrongDM gateway. Humans, machines, and AI agents all get there the same way.
PostgreSQL, MySQL, Oracle, SQL Server, MongoDB, and 20+ more.
Kubernetes, Amazon EKS, Google GKE, Azure AKS, and Docker.
AWS and AWS GovCloud, Google Cloud, and Azure.
Claude Code, Claude Desktop, Codex CLI, and GitHub Copilot.
Linux, Windows Server (RDP), and SSH-based systems.
Internal tools and HTTP/S resources, no VPN required.
UNDER THE HOOD
Tunnels requests from the user’s workstation to the gateway through a single mutually verified TLS connection. The desktop app runs on Mac and Windows. The CLI additionally supports Linux.
Authenticates the user at login, optionally redirecting to your identity provider or SSO.
Provides graphical and command-line interfaces. Developers get just-in-time access requests through the CLI, using the scripts they already run. Both interfaces work inside the tools engineers already use, so StrongDM slots into existing workflows instead of replacing them.
-1.png?width=600&height=261&name=Screenshot%20%E2%80%94%20Session%20Visibility%20(strongdm.com)-1.png)
The controlled entry point into your environment. The gateway takes a DNS entry, or it sits privately on the corporate network behind a VPN.
On a flat network, the gateway communicates with target systems directly. Where internal subnets block inbound connections, relays create a reverse tunnel back to the gateway.
Decrypts credentials on behalf of end users, machines, and AI agents, and deconstructs requests to support auditing.
Gateways and relays deploy in pairs and scale horizontally.
-2.png?width=560&height=373&name=Screenshot%20%E2%80%94%20Session%20Visibility%20(strongdm.com)-2.png)
The Admin UI stores configuration information. An administrator assigns users to StrongDM Roles., collections of grants to servers, databases, clusters, web apps, and MCP servers, and mapped from identity provider group membership.
StrongDM pushes the configuration to the end user’s local client and updated in real time.
Admins can also manage configuration as code through the CLI, API, and Terraform provider.
For AI agents, Administrators configure MCP servers as resources like anything else, with an added policy layer that controls which individual tools an agent may call., not just which resources it can reach. When an agent instead acts on a person's behalf against existing infrastructure, there's nothing extra to configure, as the agent inherits that person's roles as-is.
%20(1).png?width=560&height=271&name=Screenshot%20%E2%80%94%20Session%20Visibility%20(strongdm.com)%20(1).png)
Why It’s Different
Reframe around what runtime authorization adds rather than what other tools fail to do. Most access control ends at the grant. Runtime authorization keeps evaluating after it.
StrongDM brokers the credential at the moment of connection, scopes it to the task, and revokes it the instant the task ends, leaving nothing for an attacker to find.
StrongDM evaluates each command or query against policy before it runs and ends the session immediately if something violates policy.
Engineers and AI agents keep using the tools they already use, while enforcement happens underneath the workflow, not on top of it.
Gateways and relays deploy in pairs and scale horizontally, so a single node failure doesn’t take down access.
PROOF
“Security is a necessary part of day-to-day life. In terms of how we go forward, StrongDM will continue to be part of that story. It has all the mechanisms in place for database access control that we require, and I haven’t found a competitor yet that does the same thing.”
“We chose StrongDM because it’s the one solution to rule them all. You integrate all your data sources, servers, and Kubernetes clusters into StrongDM. Your developers get one simple tool to connect using SSO, and they have access to what they own.”
“Clearcover remains committed to the industry’s best security practices. StrongDM provides us with better insights to bolster our security posture.”
“I would urge all other CISOs to adopt StrongDM as their database proxy platform. We implemented it within a day, and within a week we saw more users requesting access once they saw how easy it was.”
“With StrongDM, people don’t have to maintain usernames and passwords for databases, keys for servers, or passwords for websites. When you eliminate the need for passwords, the attack surface is reduced.”
