Request and approve access

Request time-bound SSH access, track a decision, and approve requests without self-approval.

An access request binds a subject, policy, host group, local account, reason, and requested duration.

Request from the console

Open Access.
Choose Request access.
Select an available policy.
Select one of the policy’s allowed local accounts.
Choose a duration no longer than the policy maximum.
Enter a specific reason and optional ticket reference.
Submit.

The control plane returns only policies that the signed-in actor is allowed to request.

Request from the CLI

tenvyr access request \
  --policy POLICY_UUID \
  --host-group HOST_GROUP_UUID \
  --account deploy \
  --reason "Investigate elevated error rate" \
  --duration 1h

Check the current state:

tenvyr access status

Decision modes

Mode	Behavior
Immediate	A matching request atomically creates a time-bounded grant
One approval	One named eligible approver must approve
Two approvals	Two distinct eligible approvers must approve

Requesters can never approve their own requests.

Approve or deny

Approvers open Access, review the policy, target, local account, duration, reason, and ticket, then choose Approve or Deny. The decision and actor are appended to the tenant audit chain.

When a request is unavailable

Common reasons include:

you are not a direct subject or current member of a mapped SCIM group;
the policy is disabled;
the requested local account is not allowed;
the requested duration is too long;
the host group cannot accept more bounded compatibility state; or
an approver set no longer satisfies the policy.