Request a trial
Menu
Products
Solutions
ERP
Authentication
Apps
LearnDocsWhy SSOGENRequest a trial

SSOGEN / Just-in-Time Access for Servers and AI Agents

SSOGEN

Just-in-Time Access for Servers and AI Agents

Just-in-time access means nobody holds standing rights to a sensitive system. A person or an AI agent asks, an approver decides, and access closes on its own when the window ends.

Try SSOGEN

Just-in-time (JIT) access grants access to a sensitive resource only when someone needs it, only after an approval, and only for a fixed window. When the window ends, access ends without anyone remembering to remove it. SSOGEN applies it to servers through Remote Access and to AI agents through sensitive-scope approvals.

Standing access compared with just-in-time access

Standing access is always open. Just-in-time access is closed until a request is approved.

Standing access Just-in-time access
When access exists All the time Only inside an approved window
Who decides Whoever set up the account, once An approver, for each request
Reason on record Rarely Required with every request
Removal A manual task that is often forgotten Automatic when the window ends
What a stolen credential reaches Everything the account can reach, at any hour Nothing outside an approved window

How a server request works in SSOGEN

  1. Request. On My Apps, the host’s tile reads “Requires approval”. The person selects Request access and gives a reason, a duration and a start time.
  2. Decide. An approver opens the request from their own Approvals page, sees who asked and why, and approves or denies it.
  3. Open. Inside the window, the tile shows the time left and Open. The SSH terminal or the RDP or VNC desktop runs in the browser through the SSOGEN Gateway.
  4. Close. At the end of the window, the live session ends. A Super admin can revoke approved access earlier, which also ends the session.

The limits an administrator sets

Each Remote Access resource carries its own policy. These are the values SSOGEN enforces:

  • Longest window. 15 minutes to 24 hours, set per host.
  • Waiting time. An undecided request expires after 1 to 72 hours.
  • A real reason. Every request needs 10 to 500 characters of explanation.
  • No self-approval. The requester is never their own approver, whatever the list says.
  • A fresh second step. An approver must have completed a second sign-in step in the last 10 minutes.
  • Fail closed. A new host with no saved policy cannot be requested or opened by anyone.

Extra rights, granted per request

Clipboard and file transfer can be set to With approval for a host:

  • Asked for. The requester ticks the extra capability under Also allow.
  • Narrowed by the approver. The approver grants all, some or none of what was asked.
  • Recorded. The request record shows “Also asked for” and what was approved.

Just-in-time access for AI agents

An AI agent in SSOGEN has an owned identity and an explicit list of scopes. Mark a scope Sensitive, and each use needs a person’s decision at that moment.

Control What SSOGEN does
Sensitive scope Held until the person approves on their Approvals page, after a recent strong sign-in
Approval result A short window to use that one scope; it is not approval of one specific operation
Delegation Expires within 30 days of approval, and never after the agent’s own expiry
Agent identity An Expires on or Review by date at most 365 days ahead
Tokens Bound to the agent’s key, each valid for about four minutes
Stopping an agent Withdraw, Suspend, Revoke permanently or a kill switch for one agent type; issued tokens stop within 5 minutes

The approval page states that the person approves a short access window, not one action. AI agent identity covers the rest of the agent model.

What the audit trail shows

  • Every request. Who asked, for which resource, the reason as written, the duration and the capabilities asked for.
  • Every decision. Approved, denied, withdrawn, expired or revoked, with the approver and their note.
  • Every policy change. Saved as Access settings changed, after a review panel lists who loses access.
  • Every agent approval. Requested and decided, next to each token issued or refused.

Questions people ask

What is the role of access management in cybersecurity?

Access management decides who and what may reach each system, and under which conditions. It limits the damage of a stolen password or a compromised program, because access is granted per person, per resource and per moment. Just-in-time access tightens it further: sensitive rights exist only while an approved task is running.

What is JIT, just-in-time provisioning?

Just-in-time provisioning is a different idea with a similar name. It creates a user account in an application at the moment of the first single sign-on, from the attributes in the sign-in. JIT provisioning answers “does the account exist?”. JIT access answers “may this person use it right now?”.

What does “privileged user” mean?

A privileged user can change systems, not only use them: an administrator, a database owner, an engineer with root or local administrator rights on a server. These accounts are the main target of attackers, which is why just-in-time access applies to them first: no standing rights, an approval per task, and a record.

Can you give me an example of privileged access management?

A vendor engineer at Acme Corp needs root on build01.acme.example for one afternoon. She requests four hours with a reason, the system owner approves, and she opens the server in the browser. The session ends at the end of the window, and every step is on record. Vendor access shows this flow.

Where to go next