Flow 07 · Privilege
It already knows when it ends.
Just-in-time access isn’t a wire protocol. It’s a habit. The operator, or the agent, starts with nothing on the target. Policy lends a narrow right, and the target takes it back when the window closes.
Watch for
- The request names one action, one target, and why. “Make me an admin” is a standing role with a form in front of it.
- Write down which rule said yes. Otherwise a review is just archaeology.
- Same shape for a person or an agent. If an agent is the caller, the grant should name the agent and the person who delegated.
Failure modes
- Adding someone to a permanent group and filing a ticket to take them out later. The ticket gets lost.
- A shared break-glass account for the on-call rotation. The log says “break-glass,” not who was holding it.
- Auto-approval with no limit. That’s standing access that files a request on the way in.