Most privileged work is bursty. Ixiea treats elevation as a time-limited event — requested, approved, used, and revoked — not a permanent role assignment.
Request
Target + window
Approve
Context + duration
Connect
Grant active
Time window
Bounded elevation
Auto revoke
Sessions terminate
Elevation is an event, not a permanent role assignment.
Permanent admin rights accumulate silently — role drift, contractor extensions, break-glass accounts that never get disabled. Auditors ask who had access on a given date; standing grants make that answer expensive to reconstruct.
Standing grants
Auditors ask who had access on a date — standing grants make that expensive to reconstruct.
Request
1h · prod-db
Approve
context + duration
Connect
grant active
Expire
sessions end
On expiry: active sessions terminate · new connects denied
An operator requests access to a target or role for a defined window — one hour, one maintenance slot, one incident bridge. Approvers receive context: requester, target, justification, and suggested duration. On approval, the grant activates; on expiry, active sessions terminate and new connections are denied.
Route approvals through ServiceNow, Jira, or Slack so existing change-management workflows stay intact. Emergency break-glass bypasses exist but carry mandatory post-incident review and enhanced recording — using Ixiea itself.
ServiceNow
Jira
Slack
Break-glass bypass
Post-incident review · enhanced recording · via Ixiea
JIT cycle record
SOC 2 CC6.3 · PCI 7.1 — request to session, no spreadsheets
Every JIT cycle produces a durable record: requester, approver, window, policy version, and session artifacts. SOC 2 CC6.3 and PCI 7.1 reviewers get a straight line from access request to session activity without spreadsheet reconstruction.
Operational docs
Related guides
Entitlements follow people and roles from your IdP, not network location or shared accounts.
Inject credentials at connect time, operators never see or hold standing secrets.
Discover accounts on assets, rotate passwords on schedule, and push credentials without manual vault hygiene.
Ready to evaluate?
Walk through gateway brokering, recording, and audit exports in a working session — or browse the illustrated product flow first.
