Use cases

The situations where access matters most

Each one is a worked example on the demo organisation, Northwind Labs, with the screens at every step: what the person asks, what the agents decide, what the approver sees and what the broker does in your network.

Platform & SRE

Into the payments database during an incident

An SRE needs to read invoices during INC-4412. One sentence becomes SELECT on one table for an hour, a real login, and nothing left behind.

ask → SELECT billing.invoices → 60 min → login dropped Security

When a read-only grant reaches for a secret

A grant to read service logs, and a call to the secrets manager in the middle of it. Flagged at once; revoked at the level you set.

logs:* in scope → secretsmanager:GetSecretValue → flagged → revoke Platform & SRE

Admin in production: two people and a second factor

Rolling back a deploy without anyone keeping AdministratorAccess: step-up, two approvers, thirty minutes, four ECS actions.

risk 57 → step-up → 2 approvers → ecs:UpdateService On call

Break-glass at 3 a.m.

Instant for whoever is on call, loud for everyone else, reviewed in the morning.

on call + incident → step-up → instant → review CISO

Retiring standing admin without breaking anything

Discovery finds four standing administrators and an escalation path; each is converted to on-request access, reversibly.

discover → analyse → convert → remove Platform & SRE

kubectl in production, scoped to one namespace

Read access to the payments namespace for forty-five minutes as a RoleBinding, instead of a cluster-admin group.

get/list/watch → RoleBinding → 45 min → deleted Compliance

The quarterly access review that prepares itself

Ten lines pre-filled with usage and a recommendation; six removals executed through the broker.

campaign → pre-filled → decide → remove → export Audit

Access evidence your auditor will accept

Every request, decision, grant and removal in words, mapped to SOC 2, ISO 27001 and PCI DSS testing.

record → sample → evidence → InsightAssure

By role

What each person gets out of it

Engineers

Access in seconds, not tickets

Ask in one sentence in Slack, the console or the CLI. Low-risk requests are approved on the spot; nothing to remember to give back.

Approvers

Fewer, better decisions

Only the requests that need a person reach you, with the risk explained and the permission already narrowed. Approve from Slack.

Security

No standing admin, and proof

Session watch, standing-access cleanup and a record of every grant. Break-glass that is loud and reviewed.

Auditors & compliance

Evidence without screenshots

Prepared access reviews, removals executed and logged, and an export of grants and reviews as control evidence.