---
title: "Grant admin rights only for a set time · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/just-in-time-admin
updated: 2026-10-20
licence: "All rights reserved"
---

# Grant admin rights only for a set time

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access)
- Rule: Give nobody standing admin rights to production. Grant them on request, with a reason, for at most 8 hours, and log every grant.
- How: Set up the grants as [grant admin access for hours only](https://agentwranglers.se/playbook/infrastructure/identity-and-access/just-in-time-access) describes, and the emergency accounts as in [keep tested break-glass accounts](https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access). Cover databases, the admin tool and the code host too, not only the cloud. A second person approves grants for production data. Export every grant each quarter as evidence. ISO/IEC 27001:2022 control A.8.2 covers privileged access.
- Check: A query of the cloud and database roles finds no person with a permanent admin role, except the emergency accounts. Every grant in the last quarter has a reason, an approver and an end time within 8 hours.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/just-in-time-admin`.

- Previous: [Remove access within a day of leaving](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day)
- Next: [Keep roles as code](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/roles-as-code)
- [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access)