Admin rights that expire on their own, and a signed-off review of who holds them.
An auditor or a client asks when privileged access was last reviewed, and what came of it. Here admin rights are granted for a window, end without anyone remembering, and are reviewed on a schedule you set, with the result signed.
Two hours of prod, then the access closes by itself.
Admin rights are a grant with a reason, an approver and an end time. Every connection made under the grant is listed with its server and its run, so the answer to who had root on prod last Tuesday is a lookup.
Access record /grant #a91c on prod
- Requested
- Alex Moreau @alex at 13:58:12, for patch nginx across prod
- Approved
- Dana Okafor @dana at 14:02:40
- Window
- 14:05:00 to 16:05:00, 2h
- Ended
- Expired on its own
| Time | Server | Through | Certificate |
|---|---|---|---|
| 14:32:11 | web-01 | run #4f2a | 5 min |
| 14:32:11 | web-02 | run #4f2a | 5 min |
| 14:32:12 | web-03 | run #4f2a | 5 min |
Four rules that keep admin access small.
- Roles per environment
- A person can be an operator in staging and a viewer in prod, and get two hours of prod when the ticket says so. The environment comes from the hosts a plan targets, so prod values never run against staging by mistake.
- Grants that expire
- A grant has a start and an end. When it ends, the access ends, and the grant stays on the record with how it ended.
- The approver holds access
- Someone who approves a run in a protected environment must hold access to that environment themselves.
- Nothing to rotate when someone leaves
- Access expires on its own, so someone leaving is removed rather than every key being rotated.
Remove a person's access everywhere, in one step, with proof per host.
When someone leaves, record the leaver event. Their access is removed from every environment and every grant in one step, and the record shows it host by host.
- One step, everywhere
- The person is removed from every environment, and any grant they still hold ends, so nobody has to remember which servers they could reach.
- Proof per host
- For each host the person could reach, the record shows that the access is gone and when it ended, so the answer to whether a leaver still has access is a lookup.
Review who has access, keep or remove each person, and sign.
The signed review is the second record on the evidence page. It covers access that goes through Opafra.
Access review /prod, 1 July to 30 September 2026
| Person | Access | Decision |
|---|---|---|
| Ada LovelaceOwner | Owner role | Kept |
| Bo ChenAdmin | No grant on prod | Kept, no access |
| Alex MoreauOperator | Grants, 2 hours at a time | Kept |
| Dana OkaforOperator | Standing grant, approver | Kept |
| Eli NovakViewer | View on staging | Removed, left the team |
Ada Lovelace, Owner, 2026-10-05 10:14. 1 change made.
The requirement it answersRegulation (EU) 2024/2690, point 11.3.3
“review access rights of privileged accounts and system administration accounts at planned intervals ... and shall document the results of the review”
The review covers access that goes through Opafra. Accounts that exist on the servers themselves are reviewed where they live.
Three things an auditor asks to see.
- Everyone with access, listed
- At the interval you set, the reviewer sees each person with access to an environment, their role and their grants.
- A decision for each person
- The reviewer keeps or removes each one, and the decision is recorded next to the person.
- Signed, with the date
- The record keeps who reviewed, when, and what changed, so the review is a document and not a recollection.
Review access once and sign it.
Tell us which environments carry admin rights and who holds them. You get a demo and your price in writing within one business day, with no call.