Agent WranglersIdentity and access Required
Grant admin access for hours only
Give admin rights in production only on request, with a reason and an approver, for 8 hours at most.
How to do it
Day to day, people hold read-only roles. Raising rights goes through a tool that asks for a reason, gets a second person's approval and ends by itself. Examples are AWS's temporary elevated access solution for IAM Identity Center, Google Cloud's Privileged Access Manager and Entra Privileged Identity Management. Each grant is logged with its reason. The evidence auditors expect is in grant admin rights only for a set time.
How to check
A query of the role assignments in production finds no person with a standing admin role, except the break-glass accounts. Every admin session in the audit log has a matching approved request.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/identity-and-access/just-in-time-access.