Privileged access: request and approve

In this tutorial, we request access to a privileged account, approve it as a colleague, and see how emergency access works. Server admin accounts aren't shared. Each person requests access to one account for a limited time, someone approves, if the profile requires it, and the access ends on its own. Under Access, My access, choose Request on the account.

Pick the type: a recorded session, credential checkout, or a temporary account just for you. Enter the duration, the justification and, if you have one, the support ticket. Approvers see the request under Access, Approvals, or on their phone. They never decide their own requests. Before deciding, they compare the code with what the requester sees, over a channel of their own.

Choose Approve or Decline, and confirm with your passkey. Decline if the justification doesn't match any work you know of, or if the duration is longer than the job needs. Once approved, the requester chooses Activate and confirms with their passkey. They open the web terminal, or copy the connection command. A reveal shows the credential for thirty seconds.

When you're done, choose Release. Some accounts rotate the password on return. In an incident, the members of a restricted group can request emergency access: up to sixty minutes, with the incident reference. Another member confirms within fifteen minutes, everything is recorded, and the credential is rotated at the end. Each emergency access opens a review due within seventy-two hours.

An administrator outside the group marks it justified or not justified. Treat every unjustified case as an incident. And that's it: privileged access requested, approved and time-limited. In the next tutorial, we'll look at the vault and credential rotation.