Just-in-time access
Make privileged access requested, approved, and temporary.
Shortspan lets a developer ask for the resource they need, explain why, and receive a time-bounded grant after approval. The same model covers the credential and infrastructure catalog, so temporary access is part of everyday work instead of a separate ticket-only process.
Why teams change
Permanent access is often temporary work with no end date.
Production debugging, a migration, an incident, or a release may justify elevated access for an hour or a day-not for the rest of a person’s employment. Static group membership turns these exceptions into accumulated privilege.
Shortspan models the request, decision, and expiry explicitly. Administrators can see the target and reason before approving, and the grant stops authorizing requests through Shortspan after its deadline. The result is a practical least-privilege workflow that developers can initiate from the same product they use to reach the resource.
What Shortspan adds
Control around the workflow, not another workflow beside it.
Reasoned access requests
Ask for a named project resource and preserve the business or operational reason with the request.
Explicit approval decisions
Let an authorized administrator approve or deny the request while keeping the decision attributable.
Automatic grant expiry
Put an end time on elevated access so cleanup does not depend on the requester or approver remembering later.
The workflow
From registered resource to accountable use.
- 01
Request the resource
Choose the secret, server, database, cloud account, cluster, or workflow and explain the work that requires it.
- 02
Review and decide
An authorized administrator evaluates the target, reason, requester, and requested duration.
- 03
Use it before expiry
The approved user works through Shortspan until the grant expires or is otherwise removed.
Operational outcomes
Make the secure path the understandable path.
- Reduced standing privilege for sensitive environments
- Clear reasons attached to exceptional access
- Approvals and denials that can be reviewed later
- A consistent request path across multiple resource types
Common questions
Know where the boundary is.
- Is an expired Shortspan grant the same as rotating the source credential?
- No. Expiry removes authorization through Shortspan. Rotation changes the underlying credential at its source and may be required separately depending on the security event or integration.
- Who can approve access?
- Approval is controlled by the workspace role and project permission model. The route-level authorization rules remain the final authority even when a client interface hides an unavailable action.
- Can this cover more than SSH?
- Yes. The resource catalog includes secrets, SSH servers, databases, AWS accounts, Kubernetes clusters, and operational runbooks, allowing one request model to span related workflows.
Read the implementation details
Documentation for this workflow
Related solutions
Connect the next part of the workflow
Start with one project and one access problem.
Create a workspace free, or tell us what your team needs to broker, approve, and review.