---
title: "Grant admin access for hours only · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access/just-in-time-access
updated: 2026-10-20
licence: "All rights reserved"
---

# Grant admin access for hours only

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)
- Rule: Give admin rights in production only on request, with a reason and an approver, for 8 hours at most.
- How: Day to day, people hold read-only roles. Raising rights goes through a tool that asks for a reason, gets a second person's approval and ends by itself. Examples are AWS's temporary elevated access solution for IAM Identity Center, Google Cloud's Privileged Access Manager and Entra Privileged Identity Management. Each grant is logged with its reason. The evidence auditors expect is in [grant admin rights only for a set time](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/just-in-time-admin).
- Check: A query of the role assignments in production finds no person with a standing admin role, except the break-glass accounts. Every admin session in the audit log has a matching approved request.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/identity-and-access/just-in-time-access`.

- Previous: [Keep tested break-glass accounts](https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access)
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)