What is just-in-time (JIT) access?
Just-in-time (JIT) access gives people extra access only when they need it, for a set time, and removes it automatically when the time is up.
Last updated 29 October 2026
How a just-in-time request works
- The person asks for the access they need and says why.
- A written policy decides whether an approver is needed, and who.
- Once approved, access is granted for a set period, such as a few hours or until a project ends.
- When the period ends, access is removed automatically, without anyone having to remember.
- Every step is recorded: who asked, why, who approved and when access ended.
Standing access versus just-in-time access
- Standing access stays until someone removes it, whether it's used or not. Just-in-time access ends on its own.
- With standing access, a stolen account brings all of its permissions with it. With just-in-time access, sensitive permissions exist only for the approved period.
- Security frameworks expect expiry too: NIST SP 800-53 includes a control to remove or disable temporary and emergency accounts automatically after a set time.
Where it's used
Admin roles in identity and cloud systems are a natural fit. Microsoft Entra Privileged Identity Management, for example, lets someone activate a role for a limited time, with approval, a reason and MFA if required. The same idea works for everyday apps, such as access to a design tool for a two-week review.
See how BeforeQuery's AI employees do this work, with a person approving anything that matters.
Book a demoQuestions
Is just-in-time access only for admins?
No. Admin roles are a natural fit, but the same idea works for any access needed for a limited time, such as an app for one project.
What if someone still needs access when it ends?
They ask again or request an extension, and it goes through approval like the first request. Nothing is extended silently.
How does BeforeQuery handle temporary access?
The AI ITSM Agent reads the longest access allowed from each app's policy, asks the approver the policy names, grants the access in Okta and removes it on the end date.
Hire your first AI employee
The AI Marketer is ready today, free to start. For your other teams, tell us which one needs an AI employee and we'll show you how it works with your tools.