Skip to content

Menu AuthGuardHelp centre

Troubleshooting · Privileged access (PAM)

Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03)

1 min read
SaaS · Self-hosted · Edge

Symptom and cause

Message or code	Cause	What to do
«Your organization's access policy does not allow this request.» (`pam_policy_denied`)	The policy does not allow `pam.checkout`, `pam.session` or `pam.jit` for you, this account or this time	The administrator reviews the policy
«This request needs a stronger sign-in first.» (`step_up_required`)	You signed in without a passkey	Sign in with your passkey and repeat
A message that this browser cannot use a passkey	The browser does not support passkeys	Use a current browser
`AGM02` (session or activation refused)	The lease, profile or target does not allow the action: an expired lease, a profile without recorded sessions, a profile with approval before each connection, an account with no appliance, an account that cannot rotate	Request a new lease, or the administrator fixes the profile or account
`AGM03` / "sent for approval"	Dual control is on	Another administrator approves under «Dual control»
`AGM01`	The authorization does not match the request (for example the approved escrow key is another one)	Repeat the operation from the start

Session refused on connect

If the terminal closes as soon as it opens:

Check that the lease is under «Active leases» and has not expired.
Check that the profile allows recorded sessions and does not have «Ask for approval before each connection».
Check that the target has a confirmed host key and an active appliance.
Check the appliance's health under «Operate» › «Edge appliances».

When to escalate

A repeated refusal without a visible cause, or «Integrity check failed» on a recording, must be reported to support and security.

Error codes in this article

Article referencets-pam-errorsquote it to support to identify this article. Checked against the product at commit 5f6607a8.