Temporary access: Policy model

Time-bounded access grants carry explicit expiry and revocation, propagate to caches and background jobs, and leave durable audit evidence when elevated permissions end.

Package status: AI-assisted reference package. Static package validation has passed; implementation scenarios remain not run and human domain review is required before stable adoption.

Decision

Represent elevated permissions as explicit grants with starts_at, ends_at, approver, and reason; merge them into effective access only while active; revoke immediately on operator action; and ensure caches, API gateways, and background workers observe expiry without extending privilege beyond the recorded window.

Scope

• Just-in-time elevation, break-glass roles, support impersonation, or similar temporary grants.
• Revocation, automatic expiry sweeps, extension policy, and audit logging.
• Interaction with authorization caches, session scopes, and asynchronous jobs already running.
• Notifications before expiry when configured.

Outside this block

• Permanent role assignment or group membership (see permission inheritance block).
• Authentication ceremony for the user receiving the grant.
• Full RBAC model definition.

Contract

• Every grant records grantee, scope or role elevation, ticket reference, approver, start time, end time, and status (active, revoked, expired).
• Effective access includes grant permissions only when now is within [starts_at, ends_at) and status is active.
• Manual revocation sets status to revoked immediately; subsequent authorization checks deny elevated actions within the propagation bound.
• Automatic expiry transitions status to expired via sweeper; no silent extension occurs without a new approval record.
• Authorization caches key decisions by grant version or ends_at and cannot return allow after expiry beyond the profile cache TTL.
• Background jobs consult grant status before starting elevated steps; when profile blocks new work, expired grants prevent new elevated operations even if a worker token was minted earlier.
• Only one active grant per user is permitted when configured; overlapping requests fail fast.
• Audit stores create, revoke, expire, and extension events with actor, reason, and correlation identifiers retained for the profile period.

Implementation guidance

• Publish grant changes on an event bus so edge nodes and workers invalidate caches without waiting for TTL alone.
• Include grant ID and expiry in structured logs for elevated actions to simplify forensics.
• Separate break-glass grants with stronger approval and shorter max duration in profile overlays.
• Document behavior for in-flight operations in runbooks linked from the adoption profile.

Failure handling and safeguards

• If sweeper lag exceeds the configured interval multiple, fail closed on elevated scopes for affected grants and alert operators until backlog clears.
• If clock skew between issuers and validators exceeds the profile bound, deny grant creation rather than issuing negative-duration or backdated grants.
• Impersonation grants must be visually indicated to support agents and logged with both actor and target identities.
• Never infer grant extension from continued UI activity; extension requires explicit recorded approval.

Verification and operations

• Measure propagation latency for revoke and expiry, cache stale allow rate, and count of jobs exceeding grant window.
• Run game-day exercises revoking active grants while workers execute elevated tasks.
• Review active grants weekly; auto-close grants tied to closed tickets.

Adoption assumptions

• Names and numeric values in example.yaml are an adoption profile, not universal defaults.
• Teams define which roles are eligible for temporary elevation and how job termination behaves on expiry.

References

• owasp-authorization