Access grants
Not every request is about launching a binary. Users also need to change protected OS settings: join a Wi-Fi network, add a printer, fix a display. Access grants give time-boxed access to a settings class instead of handing out admin.
Settings classes
| Class | Covers |
|---|---|
| network | Network adapters, Wi-Fi and VPN configuration. |
| display | Display and graphics settings. |
| devices | Device and driver management. |
| printers | Printer installation and management. |
| power | Power plans and related settings. |
| time | Date, time and timezone. |
How it works
- The user requests a class from the tray, picks a duration and gives a reason. The reason is required.
- The request is MFA-protected: the grant records which factor verified the user, and the proof is stored (hashed) with the grant.
- An admin approves or denies from the web console or the iOS approver app, exactly like an elevation request.
- While the grant is live, the agent transparently satisfies the OS credential prompts for that class only. Nothing else is elevated.
- The grant expires on its own at the approved time.
Grant fields
| Field | Meaning |
|---|---|
| class_id | Which settings class the grant covers. |
| granted_at / expires_at / duration_label | The window, plus the human label the user picked ("30 minutes"). |
| reason | The user's justification. |
| mfa_method | The factor that verified the user before the request was accepted. |
| status | pending, active (approved and live; the agent may satisfy prompts) or denied; revocation details are recorded alongside. |
| use_count / last_used_at | How many times the grant actually satisfied a prompt. Surfaces never-used grants, a signal the duration or class was wrong. |
Revocation
A live grant can end three ways, each recorded with its kind:
- user: the user self-revokes from their My Access panel when done early.
- admin: an admin revokes from the grants log.
- system: expiry, device removal or tenant suspension.
Access grants answer the "I just need to change a setting" case that otherwise becomes a full admin session. Keep durations short: the use counters will tell you if users routinely need longer.