.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
Use caseJust-in-time access
Request it, use it, lose it
Just-in-time access gives an engineer exactly the access a job needs, for as long as it takes, with an approval and a record, and takes it back without anyone having to remember.
Why permanent access fails
- 01
Access requests by message
Access asked for in chat or email leaves no structured record of who approved what, and for how long.
- 02
Nobody takes it back
Removing access depends on someone remembering, so temporary access quietly becomes permanent.
- 03
Credentials end up on laptops
Handing out passwords and keys to get a job done spreads them to places you cannot see.
See it work
Build a request
Pick a target and a window, add a reason, and see how the request would be routed and when it would end.
Sample targets and rules, after the SWOT PAM and Cloud PAM demos.
Draft
- Window
- Reason
- Approval
- Delivered as
- Sent
- Approved
- Live
- Expired
How it works
How a just-in-time grant works
Ask
Pick the server, database or cloud role, the time and the reason, or link the change ticket. The AI assistant can raise it from plain English.
SWOT PAMApprove
Approvers are told at once in Slack, Microsoft Teams or email. In the cloud, a risk score picks the route: standard approval, a second approver, or step-up MFA.
SWOT Cloud PAMConnect
The proxy injects the credential, or the gateway brokers short-lived STS or OAuth credentials, so nothing reaches the engineer’s device.
Expire
The grant ends when the window closes. A revoked cloud grant stops working within 60 seconds.
The products
What each product does here
What is just-in-time access?
Just-in-time (JIT) access grants privileged access only when it is needed, for a set time, after an approval. When the time runs out the access is removed automatically, which shrinks the window an attacker could use.
Who approves a request?
The approvers your policy names. They are notified in Slack, Microsoft Teams or email and can approve from Slack or Teams. For cloud access, a deterministic risk score can require a second approver or step-up MFA.
What happens when the time ends?
The grant ends on its own; nobody has to remember to take it back. For cloud sessions a revoked grant stops working within 60 seconds, and an admin can end a live session at any time.
Can engineers ask in plain English?
Yes. SWOT PAM’s AI access assistant takes a request such as “read-only access to the billing database for two hours for incident INC-902” and checks it against policy before it is raised.
See it on your own systems
A walk-through of SWOT PAM and SWOT Cloud PAM with the team that builds them.