Access policies

Policies define who may request which SSH access and how that request becomes a grant.

Required fields

• Host group — the trust boundary.
• Subjects — direct tenant actors or provisioned SCIM groups.
• Local usernames — explicit operating-system accounts.
• Decision — immediate, one approval, or two approvals.
• Approvers — named active owners, admins, or approvers.
• Maximum grant — 15 minutes through 8 hours in the console.
• Certificate lifetime — 1, 5, or 10 minutes.
• Credential mode — hardware-backed, user certificate, compatibility, service, or break glass.
• Privilege profile — login, administrator, or command allowlist.

Subject selection

Prefer SCIM groups for workforce access so directory membership is the source of truth. Use direct actors for small exceptions and recovery identities.

Approval design

• Use immediate access only for low-risk, tightly bounded workflows.
• Use one approval for routine production access.
• Use two approvals for high-impact administrative or regulated access.
• Include enough eligible approvers to cover absence and incident load.
• Never make a requester the only eligible approver; self-approval is rejected.

Privilege profiles

Login only permits normal SSH login under the selected account.

Administrator applies the supported elevated privilege mapping for the platform.

Command allowlist accepts clean absolute executable paths only. Arguments, shell syntax, relative paths, and traversal are rejected.

Disable a policy

Disabling a policy atomically cancels pending requests and revokes active grants and issued certificates, then publishes revocation state. The operation requires a reason, evidence reference, and recent MFA. It cannot close an already-open SSH session.