HashiCorp Boundary

Connection methods

• PAM vault API (read-only)
• Session recording metadata export
• SIEM forwarding of privileged sessions
• CSV access certification reports

Documentation topics

Review the following areas in HashiCorp Boundary admin and product documentation before connecting to ComplAI:

• Admin console setup and service account creation
• API authentication, scopes, and rate limits
• Audit log export and retention settings
• Security hardening and least-privilege configuration

ComplAI integration overview

HashiCorp Boundary integrates with ComplAI to support Propel Ready Solutions's GRC program. Identity-based secure session access to dynamic infrastructure. This guide covers product context, the recommended connection process, prerequisites, and verification steps for audit-ready evidence collection.

Last updated: 2026-06-24

GRC evidence available

• Privileged account inventory
• Session recording coverage
• JIT activation audit logs
• Vault credential rotation status
• Session brokering metrics and configuration evidence
• Dynamic credentials metrics and configuration evidence

Prerequisites

• Named integration owner and backup contact at Propel Ready Solutions
• Change request approved per Propel Ready Solutions change management policy
• Network egress allowlisting completed if required by vendor
• ComplAI organization administrator access
• Admin or integration-builder role in HashiCorp Boundary
• HashiCorp Boundary product documentation reviewed (see Documentation topics below)

Integration process

1. Step 1

   Plan HashiCorp Boundary integration scope

   Confirm which Session brokering and Dynamic credentials capabilities will be connected first. Start with read-only ingestion before enabling write actions.

2. Step 2

   Inventory privileged accounts and vaults

   Document all privileged systems, break-glass accounts, and vault coverage scope in ComplAI.

3. Step 3

   Configure PAM platform API access

   Create read-only API credentials for session metadata, vault inventory, and activation audit logs.

4. Step 4

   Enable session recording and JIT policies

   Verify session monitoring, approval workflows, and time-bound elevation are enforced for admin access.

5. Step 5

   Map to access review cycles

   Include privileged access recertification in quarterly entitlement reviews and leadership reporting.

6. Step 6

   Mark integration complete in ComplAI

   Update integration status to Connected, attach configuration evidence, and link mapped controls in the Controls library.

GRC benefits

• Privileged access evidence for ISO A.8.2 and SOC 2 CC6.1–CC6.3
• Session audit trails for incident investigation and regulator requests
• JIT elevation metrics for least-privilege enforcement programs

Related controls

Verification checklist

• ☐Integration credentials stored securely and rotation scheduled
• ☐Test sync completed successfully with sample records
• ☐Error alerting configured for failed sync or API rate limits
• ☐Control mappings documented in ComplAI
• ☐Evidence sample exported and reviewed by control owner
• ☐Runbook link attached to related controls

Troubleshooting