Getting started

1. Enroll a broker

In Integrations → Enroll a broker, name it and copy the one-time install command. Run it on a host in the network that can reach your systems. The broker connects out over HTTPS; open no inbound ports.

docker run -d --name insightkeys-broker --restart unless-stopped \
  -v /var/lib/insightkeys-broker:/var/lib/insightkeys-broker \
  -e ACCESS_CONTROL_PLANE=https://app.insightkeys.com \
  -e ACCESS_ENROLL_TOKEN=iab_…one-time… \
  -e ACCESS_BROKER_NAME=prod-us-east-1 \
  vserveinc/insightkeys-broker:1.0.0

Mount a broker.yaml to set your local policy (see Broker & security). The broker shows as Online within a poll.

2. Give the broker its credential

• AWS IAM Identity Center — an IAM role the broker assumes, allowed to create and delete permission sets and account assignments (sso:*PermissionSet*, sso:*AccountAssignment*) and read the identity store
• AWS IAM — create, tag and delete roles with a name prefix (ik-*) and their inline policies
• PostgreSQL — a role with CREATEROLE, pg_signal_backend and pg_read_all_stats, plus GRANT OPTION on the tables it may hand out. Not a superuser.
• Kubernetes — a service account allowed to manage RoleBindings and read bindings

Credentials stay in the broker’s environment or broker.yaml; they are never sent to the control plane.

3. Connect and discover

In Integrations → Add integration, choose the kind and the broker, and give the non-secret settings (account and Identity Center instance, database host and name, cluster API server). Press Discover: resources fill the Catalog and existing access appears under Standing access. Set an owner and a sensitivity on each resource, and review the default entitlements (Read / Write / Admin) and their ceilings.

4. Write your flows

In Access flows, start from the defaults: break-glass for whoever is on call, automatic low-risk reads, automatic non-production, owner-approved writes, two-person production admin. Use the simulator to check a requester and an entitlement before you turn a flow on. Adjust thresholds and risk weights in Settings.

5. Ask

# console, Slack (/access …) or the CLI
# the insightkeys CLI ships with the broker package, provided with your workspace
export INSIGHTKEYS_URL=https://app.insightkeys.com INSIGHTKEYS_TOKEN=<your token>
insightkeys request "read the payments database for INC-4412, 2 hours"
insightkeys step-up AR-0012 123456  # an authenticator code, when asked
insightkeys grants                  # what I hold, and for how long
insightkeys credential <grant id>   # a database login, shown once
insightkeys revoke <grant id>       # give it back early

6. Connect Slack and Duo

In Settings, add the Slack bot token, signing secret and channel, and the Duo Auth API integration key, secret and host. Secrets are sealed and never shown again. Each person adds a factor under My security.