Time-bounded access grants carry explicit expiry and revocation, propagate to caches and background jobs, and leave durable audit evidence when elevated permissions end.
Package status: AI-assisted reference package. Static package validation has passed; implementation scenarios remain not run and human domain review is required before stable adoption.
Decision
Represent elevated permissions as explicit grants with starts_at, ends_at, approver, and reason; merge them into effective access only while active; revoke immediately on operator action; and ensure caches, API gateways, and background workers observe expiry without extending privilege beyond the recorded window.
Scope
- Just-in-time elevation, break-glass roles, support impersonation, or similar temporary grants.
- Revocation, automatic expiry sweeps, extension policy, and audit logging.
- Interaction with authorization caches, session scopes, and asynchronous jobs already running.
- Notifications before expiry when configured.
Outside this block
- Permanent role assignment or group membership (see permission inheritance block).
- Authentication ceremony for the user receiving the grant.
- Full RBAC model definition.
Contract
- Every grant records grantee, scope or role elevation, ticket reference, approver, start time, end time, and status (
active,revoked,expired). - Effective access includes grant permissions only when
nowis within[starts_at, ends_at)and status isactive. - Manual revocation sets status to
revokedimmediately; subsequent authorization checks deny elevated actions within the propagation bound. - Automatic expiry transitions status to
expiredvia sweeper; no silent extension occurs without a new approval record. - Authorization caches key decisions by grant version or
ends_atand cannot return allow after expiry beyond the profile cache TTL. - Background jobs consult grant status before starting elevated steps; when profile blocks new work, expired grants prevent new elevated operations even if a worker token was minted earlier.
- Only one active grant per user is permitted when configured; overlapping requests fail fast.
- Audit stores create, revoke, expire, and extension events with actor, reason, and correlation identifiers retained for the profile period.
Implementation guidance
- Publish grant changes on an event bus so edge nodes and workers invalidate caches without waiting for TTL alone.
- Include grant ID and expiry in structured logs for elevated actions to simplify forensics.
- Separate break-glass grants with stronger approval and shorter max duration in profile overlays.
- Document behavior for in-flight operations in runbooks linked from the adoption profile.
Failure handling and safeguards
- If sweeper lag exceeds the configured interval multiple, fail closed on elevated scopes for affected grants and alert operators until backlog clears.
- If clock skew between issuers and validators exceeds the profile bound, deny grant creation rather than issuing negative-duration or backdated grants.
- Impersonation grants must be visually indicated to support agents and logged with both actor and target identities.
- Never infer grant extension from continued UI activity; extension requires explicit recorded approval.
Verification and operations
- Measure propagation latency for revoke and expiry, cache stale allow rate, and count of jobs exceeding grant window.
- Run game-day exercises revoking active grants while workers execute elevated tasks.
- Review active grants weekly; auto-close grants tied to closed tickets.
Adoption assumptions
- Names and numeric values in
example.yamlare an adoption profile, not universal defaults. - Teams define which roles are eligible for temporary elevation and how job termination behaves on expiry.