1 min lesson
Group-based access is the unit of provisioning
Explain your answer to "Why is group-based access the foundation that makes JML automation and access reviews actually work?" Add one concrete detail from the lesson.
Step 1 of 3
Group-based access is the unit of provisioningno manual one-offs
Access should derive from role and attributes, never from a manual "add Jordan to this app" request. When access is a property of who you are, JML automation can grant and revoke it deterministically. One-off grants are exactly the entries that survive offboarding and show up in an audit.
Learn more
Full explanation
Least privilege and just-in-time elevation
Least privilege and just-in-time elevationshrink standing access
Standing vs JIT
- Standing access
- Always-on permission; the larger your attack surface and audit burden
- Just-in-time, or JIT
- Elevation requested for a task and granted for hours, then auto-expires
- Default posture
- Revoke by default; access has to be justified to persist
For sensitive systems such as production, the IdP admin console and finance, a person approves the elevation or policy auto-approves it. Either way the audit log shows exactly who held power and for how long.