The identity provider's role assignment for engineer@example.com, with its expiry time, read after the grant.
Workflows · Privileged-access grants
Grant production admin for two hours, then let it lapse.
Close the CC6.1 production-admin test: grant the role to one engineer for two hours after the Security owner approves, read the expiry back, and keep the receipt.
Example workflow. Execution requires a configured tool with provider permissions for this action; see the connection’s operation reference or bring your company tool to the demo.
Agent request
Grant production-admin to engineer@example.com for two hours
The role permits changes to production systems during the grant window.
- Identity
- access-agent · IT operations
- Target
- engineer@example.com · production-admin
- Cost
- Recorded agent cost
- Evidence
- Access request, duration, and ticket reference
SOC 2 CC6.1
Sensitive: waits for a named approver.
The request, the Security owner's reason, the role before and after, the expiry, and the re-run of the CC6.1 test.
Policy decision
Production-admin grants require the Security owner.
Security owner
The action waits until this owner approves or denies it.
Tool call resumes
The identity provider applies the role with a two-hour expiry, Deixic reads the assignment back, and the receipt attaches to the test.
Tool call stays blocked
The recipient keeps current access and the role is not granted.
Execution order
The agent request stops before the connected tool runs.
- 01Access agent requests the role grant
- 02Deixic checks recipient, role, duration, and policy
- 03Security owner decides
- 04Connected identity tool returns the grant result
- 05Deixic reads the assignment and its expiry back and attaches the receipt to CC6.1
Activity history keeps the request, decision, cost, and result.
Keep the procedure for the next request.
Keep the policy and decision history, save the steps and evidence as a skill, and test changes on real sessions; an approval stays specific to its request.