- contact@verticalserve.com
Platform
Every step of access, from the sentence to the expiry
InsightKeys handles the whole lifecycle in one product: a catalog of what can be asked for, agents that prepare and scope requests, flows and an explained risk score that decide them, a broker that grants and removes access in your network, session watch, standing-access cleanup, access reviews and the audit trail.
1 · Ask
One sentence, wherever the engineer already is
An engineer types what they need and why: “read the auth logs on prod-core for INC-4412, 45 minutes”. The Intake agent matches it against your catalog — the resources discovery found and the entitlements you defined — and drafts the request: resource, access level, duration, ticket and reason. It never names a resource that is not in the catalog, and it shows the alternatives it considered.
The engineer sees the risk score and the route before submitting. Nothing is saved until they confirm.
- Console — the request box, with the catalog one click away
- Slack —
/access <sentence>, with approve and deny buttons for approvers, signature-verified - CLI —
insightkeys request "…",insightkeys grants,insightkeys credential,insightkeys revoke - API — the same endpoints the console uses
2 · Scope
Least privilege, written for this request
Each entitlement has a ceiling — the most it can ever grant. The Least-privilege scoper writes the narrowest permission inside it that does the job, from the request’s words, the resource’s detail (log groups, buckets, services, tables) and what people with the same need actually used in past grants. Every narrowing is shown with its reason, and the requester can widen it back to the ceiling if they must — which the risk score then sees.
- “Payments-api logs” → six
logs:*actions on/ecs/payments-api*, not read-only on the account - “Fix one invoice” → INSERT, SELECT, UPDATE on
billing.invoices, not DELETE on every table - “Roll back the auth deploy” → four ECS actions on
service/auth*, not AdministratorAccess - Escalation-capable actions (
iam:PassRole,iam:CreatePolicyVersion…) are scored, and can be refused by the broker
3 · Decide
Flows say who may ask for what. The risk score says how hard to look.
An access flow matches the requester and the resource and sets the approval mode, the longest grant, ticket and reason rules, business hours, step-up and break-glass. The Risk agent scores every request from named factors; low risk inside the flow’s allowance is approved on the spot, and everything else goes to people.
Automatic
Approved in seconds
Score at or under 30 (your threshold) and a flow that allows it. Typical: the on-call SRE reading logs during an open incident.
Owner or named
The person who knows the resource
The resource owner, or any named approver, in the console or with Slack buttons. Security when there is no owner.
Step-up
Prove it is you
From a score of 55, or when the flow asks: a Duo push or an authenticator code before approvers even see the request.
Two people
Neither is the requester
From 75, or for admin in production: two different approvers, after the step-up, with a ticket.
Break-glass
Instant, loud, reviewed
For whoever is on call: granted after a step-up, security told at once, a review item opened for the morning.
Simulator
Test a flow before it runs
Pick a requester, an entitlement, a duration and a time; see which flow matches, the score and the route.
4 · Grant
A signed instruction, executed in your network
When a request is approved, the control plane signs an instruction with your organisation’s key and queues it for the broker that manages that system. The broker checks the signature, the nonce, the expiry and its local policy, then creates exactly that grant and records it in its own ledger.
- AWS IAM Identity Center — a permission set per grant with the scoped policy inline, assigned to the person, deleted at expiry
- AWS IAM — a role per grant only the person’s principal may assume
- PostgreSQL — a login role with
VALID UNTILand table-level privileges; the password is shown once; sessions are terminated at revoke - Kubernetes — a RoleBinding per grant to a ClusterRole scoped to the namespace
5 · Watch
Session watch: what was done, against what was asked
The broker reports activity on each grant — CloudTrail events, database activity, Kubernetes audit. Session watch checks every action against the grant’s scope and the reason given, and marks sensitive actions. A grant to read logs that reaches for the payment provider’s secret is flagged at once, even when AWS denied the call.
- L2, the default — security is asked to approve a revoke, from the agent inbox or Slack
- L3 / L4 — the agent revokes, and tells the person and security why
- Every event is kept with the grant, for the review and the auditor
6 · Expire
Every grant ends on its own
Access ends at its expiry twice over: the control plane sends a revoke, and the broker revokes from its own ledger on its own clock, so an outage on our side cannot leave access in place. A person can give access back early; an extension is a new, smaller request that is scored again.
- Active grants with the minutes left, everyone’s or mine
- Revoke now, with a reason, by the holder, an approver or security
- Database logins expire in PostgreSQL itself (
VALID UNTIL) as a third line
Standing-access cleanup
Find the access that should not exist, and convert it safely
Discovery reads what already exists: Identity Center assignments and IAM authorization details on AWS, roles and privileges in PostgreSQL, bindings in Kubernetes. The identity analysis (shared with InsightFortify) finds standing administrators, privilege-escalation paths, roles unused for 90 days and database superusers, each with a risk score and its last use.
- Convert to JIT — the cleanup agent proposes an on-request entitlement and the removal of the standing grant, with the before and after
- Accept — keep it on purpose, with a note and an end date
- Removal runs through the broker like any revoke, and is reversible
Access reviews
The quarterly review that prepares itself
Start a campaign for a scope — production, standing access and the last 90 days of grants. The Access reviewer pre-fills every line with keep or remove and the reason: last use, uses in 90 days, role and risk. The reviewer confirms or changes each line, or takes all the recommendations at once. Remove takes the access away through the broker.
- CSV export of every line and decision
- Evidence for SOC 2, ISO 27001 and PCI DSS access-review controls
- Grants and reviews exported to InsightAssure as control evidence
Agents
Seven agents. Each one on a dial you control.
Agents do the preparation and the routine decisions. Each governed agent runs at L1 Draft, L2 Ask first, L3 Act and tell, or L4 Act, per organisation and capped by the deployment. Every action is in the agent inbox and the audit trail, and can be approved, rejected or undone.
Intake
Drafts the request
From the sentence and the catalog. The requester confirms.
Least-privilege scoper · L3
Narrows the permission
Inside the ceiling, from the words and past usage.
Risk & approval · L3
Scores and auto-approves
Only where the flow and the score allow.
Session watch · L2
Flags and asks to revoke
Revokes on its own at L3 or L4.
Standing-access cleanup · L1
Proposes conversions
Standing admin to on-request access.
Access reviewer · L3
Pre-fills reviews
Keep or remove, with the reason, per line.
Copilot
Answers questions
“Who has write on prod right now?” — read-only, with links.
Your rules first
Flows, thresholds, weights
Agents work inside the flows, thresholds and risk weights you set.
Integrations
What it connects to today, and what is next
Every driver runs in the broker. Discovery fills the catalog and finds standing access; grants and revokes go through the same driver.
Available
AWS
IAM Identity Center permission sets and assignments; IAM roles; discovery of accounts, assignments and IAM authorization details with escalation analysis.
Available
PostgreSQL
Login roles per grant with VALID UNTIL, table-level privileges, sessions terminated at revoke; discovery of roles, superusers and privileges.
Available
Kubernetes
A RoleBinding per grant to a namespace-scoped ClusterRole; discovery of cluster-admin and admin bindings.
Available
Slack
Request with a slash command; approve or deny with buttons; signature-verified.
Available
Duo & authenticator apps
Step-up by Duo push or any TOTP authenticator app. Sign-in MFA from your identity provider over OIDC.
Available
InsightAssure & InsightFortify
Grants and reviews as audit evidence in InsightAssure; the cloud identity analysis shared with InsightFortify.
Google CloudMicrosoft AzureMySQLMongoDBSnowflakeGitHub
Okta & Entra groupsPagerDuty & Opsgenie on-callJira & ServiceNow ticketsMicrosoft TeamsPasskey step-upSSH & kubectl session recording