platform / just-in-time access
Admin rights for a window. Then gone.
Nobody keeps admin rights. A JIT policy sets who can request which rights, for how long, and who approves. Access is granted on request and expires on its own.
At a glance
Nobody keeps admin rights.
Access exists only when a policy allows it, and only for the window that was approved.
What it does
Grants admin rights for an approved time window, then removes them automatically.
What it replaces
Standing membership in Domain Admins, sudoers and DBA roles like db_owner.
How it's set
A JIT policy: who can request, on which systems, which role, for how long, and who approves.
What you need
The AuthNull Gateway for servers, or the DB agent for databases.
With JIT and the Gateway, people never hold long-lived credentials. The vault holds them and rotates them.
How it works
From policy to expiry.
- 01
Policy
You create a JIT policy: who can request, on which systems, which role, the longest window, and when approval is needed.
setupactive- who
- ops-admins
- target
- web-prod-*
- role
- sudo · max 1 h
- auto
- 08:00–18:00
- 02
Request
An admin covered by the policy picks a target, gives a reason and sets a duration. Without a policy, there is nothing to request.
22:40submitted- user
- a.admin
- target
- web-prod-01
- role
- sudo · 30 min
- 03
Approval
Inside the policy's auto window, it's approved at once. Otherwise an approver reviews it in the AuthNull console.
22:43approved- match
- after 18:00
- by
- j.lee
- until
- 23:13
- 04
Expiry
When the window ends, the rights are removed. The next privileged command fails.
23:14revoked- $ sudo systemctl status nginx
- a.admin is not in the sudoers file.
Where it works
The admin rights people hold today.
Interactive demo
Play both sides of a request.
A sample JIT policy is in place. Request access as a.admin, approve it as j.lee if the policy asks, and watch it expire on the server.
After hours. Goes to j.lee for approval.
On the servera.admin@web-prod-01
- 22:40$ sudo systemctl restart nginxa.admin is not in the sudoers file.
The same command works only inside the window.
Requestnot started
Request
a.admin asks for access with a reason and a duration.Policy check
AuthNull checks the request against policy.Approval
j.lee approves, if policy asks.Access
sudo on web-prod-01 for 30 minutes.Expiry
The rights are removed on their own.
Sample policy: requests between 08:00 and 18:00 for up to 1 hour are approved automatically. Your policies use your own servers, roles and approvers.
Compliance
Least privilege your auditor can read.
Every request, approval, grant and removal is logged: who asked, for what, why, which policy allowed it, who approved, and when it ended.
PCI DSS 4.0
Req. 7
Access to system components is limited to least privilege and need to know.
EvidenceWho asked for access, why, and when it ended.
CMMC
AC.L2-3.1.5
Least privilege applies to all accounts, including privileged ones.
EvidenceEvery grant and removal, per user.
SOC 2
CC6.3
Access is granted, changed and removed based on roles and least privilege.
EvidenceWho approved each request and when it was removed.
AuthNull supports evidence collection for these controls. It does not certify compliance.
Book a demo
We’ll review your Domain Admins, sudoers and DBA roles and show which can move to just-in-time.
- You send the formTwo minutes: who you are and what you want to protect.
- We reply within a dayAn engineer emails you to pick a time.
- A live 20-minute demoShown against your setup, with time for questions.