Ask HN: What are your PIM/PAM best practices?

As a developer, I'm getting into the privilege access management domain and am interested in current best (and bad) practices, plus any canonical resources that have been helpful. What PIM/PAM providers does your organization use? Any homegrown systems?