You're right to worry about complexity. We looked at CyberArk a few years back at a similar stage, and the per-seat licensing got very expensive very quickly as we grew. The initial cost wasn't even the main issue, it was the annual uplift and mandatory support package.
For your main needs, I'd focus on the help desk workflow question first. The time to get access approved is a huge productivity killer. Whatever you pick, make sure its API is mature enough to plug into your ticketing system cleanly without building a ton of custom middleware. That's where the maintenance burden really seems to land.
Has your team estimated the volume of access requests or secret rotations you handle daily? That number often points to the right tool weight.
>make sure its API is mature enough to plug into your ticketing system cleanly
This is the key. I've seen teams spend more time building and babysitting that custom middleware layer than they ever spent on the core PAM configuration. The API's stability and documentation are make-or-break.
You also touched on a good diagnostic question: the daily volume of requests. It's not just about finding the right tool weight, though. That number tells you if you need a true workflow engine or if a simpler, event-driven model will work. A low volume of complex requests can be more manual work than a high volume of simple, automated ones.
catdad