What it does. Implements Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound access, covering approval workflows, automatic expiration/revocation, and PAM/IGA integration. Use when designing access approval workflows or replacing standing privileged accounts with time-bound, zero-trust-aligned grants. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-just-in-time-access-provisioning, or copy the skill folder into ~/.claude/skills/implementing-just-in-time-access-provisioning/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-just-in-time-access-provisioning/SKILL.md
SKILL.md (verbatim)
name: implementing-just-in-time-access-provisioning
description: >-
Implements Just-In-Time (JIT) access provisioning to eliminate standing
privileges by granting temporary, time-bound access, covering approval
workflows, automatic expiration/revocation, and PAM/IGA integration. Use when
designing access approval workflows or replacing standing privileged accounts
with time-bound, zero-trust-aligned grants.
domain: cybersecurity
subdomain: identity-access-management
tags:
- iam
- identity
- access-control
- jit
- provisioning
- zero-trust
- least-privilege
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AA-01
- PR.AA-02
- PR.AA-05
- PR.AA-06
mitre_attack:
- T1078
- T1110
- T1556
- T1098
Implementing Just-In-Time Access Provisioning
Overview
Implement Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound access only when needed. This skill covers JIT architecture design, approval workflows, automatic expiration, integration with PAM and IGA platforms, and alignment with zero trust principles.
When to Use
- When deploying or configuring implementing just in time access provisioning capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Familiarity with identity access management concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Design JIT access request and approval workflows
- Implement time-bound access grants with automatic expiration
- Configure risk-based approval routing (auto-approve low-risk, multi-approval for high-risk)
- Integrate JIT with PAM for privileged access elevation
- Monitor and audit all JIT access grants and usage
- Reduce attack surface by eliminating standing privileges
Key Concepts
JIT Access Models
- Broker and Remove: Grant access through approval, auto-remove after time window
- Elevation on Demand: User has base access, elevates to privileged upon request
- Account Creation/Deletion: Temporary account created, destroyed after use
- Group Membership Toggle: Add to privileged group temporarily, auto-remove
Zero Standing Privilege (ZSP) Principle
- No user has permanent privileged access
- All privileged access requires explicit request with business justification
- Access automatically expires after defined time window
- All access events logged and auditable
Workflow
Step 1: Identify Eligible Access Types
- Privileged admin access (domain admin, root, DBA)
- Production environment access
- Sensitive data access (PII, financial, healthcare)
- Emergency/break-glass access
- Third-party vendor access
Step 2: Design Approval Workflows
- Self-service request portal with justification requirement
- Auto-approve for pre-authorized low-risk access (< 1 hour)
- Single approver for medium-risk (manager or resource owner)
- Dual approval for high-risk (manager + security team)
- Emergency bypass with post-facto review
Step 3: Implement Time-Bound Access
- Configure maximum access duration per resource type
- Implement countdown timer with extension request capability
- Auto-revoke at expiration regardless of session state
- Grace period notification (15 min before expiry)
- Automatic session termination on access expiry
Step 4: Integration Architecture
- Connect to IAM/IGA platform for provisioning/de-provisioning
- Integrate with PAM for privileged credential checkout
- Connect to ITSM for ticket correlation
- Forward events to SIEM for monitoring
- API integration for programmatic access requests
Step 5: Monitoring and Compliance
- Log all JIT requests, approvals, grants, and revocations
- Alert on access used beyond approved scope
- Track access not used (request but never connected)
- Measure mean time to access (request to grant)
- Report on access patterns for baseline optimization
Security Controls
| Control |
NIST 800-53 |
Description |
| Temporary Access |
AC-2(2) |
Automated temporary account management |
| Least Privilege |
AC-6 |
Time-bound minimum access |
| Access Enforcement |
AC-3 |
Automated access grant/revoke |
| Audit |
AU-3 |
Complete JIT access audit trail |
| Risk Assessment |
RA-3 |
Risk-based approval routing |
Common Pitfalls
- Setting time windows too long, negating JIT benefits
- Not implementing automatic revocation at expiration
- Complex approval workflows causing access delays for legitimate needs
- Not providing emergency bypass for critical incidents
- Failing to audit approved but unused JIT access
Verification
Other files in this skill
assets/template.md (verbatim)
JIT Access Provisioning Policy Template
Resource Classification
| Resource Type |
Risk Level |
Max Duration |
Auto-Approve |
Approvals Required |
| Read-only access |
Low |
1 hour |
Yes |
0 |
| Standard application |
Medium |
4 hours |
No |
1 (manager) |
| Production server |
High |
4 hours |
No |
2 (manager + security) |
| Database admin |
Critical |
2 hours |
No |
2 (DBA lead + security) |
| Domain admin |
Critical |
1 hour |
No |
2 (security + CISO) |
| Cloud admin |
Critical |
2 hours |
No |
2 (cloud team + security) |
Approval Workflow Matrix
| Risk Level |
Standard Request |
Emergency Request |
| Low |
Auto-approve |
Auto-approve |
| Medium |
1 approval |
Auto-approve + post-review |
| High |
2 approvals |
Immediate grant + post-review |
| Critical |
2 approvals + MFA |
Immediate grant + incident review |
- Requester name and ID
- Target resource/system
- Access level requested
- Duration requested (within policy maximum)
- Business justification
- Related ticket/incident number
- Emergency flag (yes/no)
SLA Targets
| Metric |
Target |
| Mean time to access (low risk) |
< 1 minute |
| Mean time to access (medium risk) |
< 15 minutes |
| Mean time to access (high risk) |
< 30 minutes |
| Emergency access grant |
< 2 minutes |
| Access revocation at expiry |
Immediate (< 1 minute) |
| Post-emergency review |
Within 24 hours |
Monitoring Alerts
references/api-reference.md (verbatim)
API Reference: Implementing Just-In-Time Access Provisioning
Azure AD PIM API (JIT for Azure)
import requests
headers = {"Authorization": "Bearer <token>"}
# Activate eligible role
requests.post(
"https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests",
headers=headers,
json={"action": "selfActivate", "roleDefinitionId": ROLE_ID,
"directoryScopeId": "/", "justification": "Incident response",
"scheduleInfo": {"expiration": {"type": "afterDuration", "duration": "PT4H"}}})
JIT Risk-Based Approval
| Risk Level |
Approval |
Max Duration |
| Low |
Auto-approve |
4 hours |
| Medium |
Manager |
8 hours |
| High |
Manager + Security |
4 hours |
| Critical |
CISO + Manager + Security |
2 hours |
AWS IAM Access Analyzer
# Find unused permissions for JIT conversion
aws accessanalyzer list-findings --analyzer-arn ARN --filter '{"status": {"eq": ["ACTIVE"]}}'
CyberArk PAS REST API (JIT Privileged Access)
# Request JIT access
curl -X POST "https://VAULT/PasswordVault/api/MyRequests" \
-H "Authorization: $TOKEN" \
-d '{"AccountId": "ACC_ID", "Reason": "Maintenance", "TicketingSystemName": "ServiceNow"}'
Key Metrics
| Metric |
Target |
| Avg approval time |
< 15 min |
| Auto-approval rate |
40-60% (low risk) |
| Standing privilege reduction |
> 80% |
| Expired access auto-revoked |
100% |
References
references/standards.md (verbatim)
Standards and References - Just-In-Time Access Provisioning
NIST Standards
- NIST SP 800-207: Zero Trust Architecture - Section 3 (Logical Components)
- NIST SP 800-53 Rev 5:
- AC-2(2): Automated Temporary and Emergency Account Management
- AC-2(3): Disable Accounts
- AC-6: Least Privilege
- AC-6(5): Privileged Accounts
- NIST SP 1800-35: Implementing a Zero Trust Architecture
Zero Trust Frameworks
- CISA Zero Trust Maturity Model: Identity pillar - dynamic access provisioning
- DoD Zero Trust Reference Architecture: JIT/JEA requirements
- Forrester ZTX: Extended Zero Trust with JIT access
- Microsoft Entra PIM: Privileged Identity Management with JIT elevation
- CyberArk JIT: Privileged access on-demand
- SailPoint: Identity governance with access request workflows
- HashiCorp Boundary: Just-in-time access to infrastructure
- StrongDM: Dynamic access management
Compliance
- SOX: Least privilege for financial system access
- PCI DSS 4.0: Requirement 7.2 - Access based on need to know
- HIPAA: Minimum necessary standard for PHI access
references/workflows.md (verbatim)
Just-In-Time Access Provisioning Workflows
Workflow 1: Standard JIT Access Request
Steps:
- User submits access request via self-service portal
- Request includes: target resource, duration, business justification
- System calculates risk score based on resource sensitivity and user context
- Risk-based routing:
- Low risk (< 1 hr, non-privileged): Auto-approve
- Medium risk: Route to resource owner for approval
- High risk (privileged, production): Dual approval required
- Approver notified via email/Slack/Teams
- Approver reviews and approves/denies with comments
- On approval: system provisions access with time-bound constraint
- User notified of access grant with expiration time
- At expiration: system automatically revokes access
- All events logged for audit trail
Workflow 2: Emergency JIT Access (Break-Glass)
Steps:
- User declares emergency and requests immediate access
- System grants access immediately without pre-approval
- Access limited to shorter maximum duration (e.g., 2 hours)
- Security team notified of emergency access grant
- User must provide justification within 24 hours
- Manager and security team perform post-facto review
- If review finds access unjustified: security incident opened
- All emergency access events flagged in audit reports
Workflow 3: Privileged Elevation with PAM Integration
Steps:
- User requests privilege elevation through JIT portal
- Approval obtained per risk-based workflow
- JIT system triggers PAM credential checkout
- PSM session initiated with time-bound credential
- User performs privileged operations via isolated session
- Session recorded for audit
- At expiration: session terminated, credential checked in, password rotated
- JIT access record closed
Workflow 4: Vendor/Third-Party JIT Access
Steps:
- Internal sponsor submits access request on behalf of vendor
- Request includes: vendor identity, scope, duration, project reference
- Dual approval required (sponsor manager + security)
- Temporary account created with MFA enrollment
- Access restricted to specified resources only
- Network access limited to authorized segments
- Session monitoring enabled
- Account deactivated at expiration
- Account deleted after 30-day retention period
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.