Automate the lifecycle without flattening human judgment.

Access Lifecycle

Every access request follows the same path.

Requests flow through policy evaluation, approval routing, bounded grants, and automatic revocation. The lifecycle runs without manual intervention for low-risk access, with humans in the loop for sensitive requests.

01
RequestUser submits access request with context
02
EvaluatePolicy engine matches conditions
03
RouteAuto-approve or escalate to reviewer
04
GrantTime-bounded access provisioned
05
ExpireAccess revoked on schedule
71%requests auto-routed
43mmedian approval time
99.2%expiry compliance
Intelligent Routing

Low-risk access auto-approves. Sensitive access escalates.

Policy determines the routing path. Requests matching low-risk conditions auto-route and grant immediately. Sensitive requests go to the right manager or owner with full context attached.

  • Request → policy → approval → active → expiry → revoke lifecycle
  • Two-track flow: auto-route low-risk, escalate sensitive requests
  • Human approval remains authoritative for high-sensitivity access
  • Events emitted for every state transition
  • Suggested durations and approval likelihood from policy context
Auto-route
71%
Manager
19%
Owner
7%
Escalated
3%
FIG. 2.3 / Automation Surfacededupe, policy, rotation, SLA

Four automation checks sit on the same surface: duplicate grants, policy routing, reviewer availability, and SLA state. The dividers make the workflow feel like one operating panel instead of scattered cards.

Possible standing access
JIT-1242prod-admin grant overlaps break-glass role
JIT-1245contractor has duplicate GitHub team path
JIT-1248workspace admin request matches standing grant
Sensitive resources

Updated by policy sync 1h ago

WhenResource tiercontainsprod, finance, secrets
ThenRouteOwner review
Approval rotation
Available by access window
Maya10:00 -> 14:00
Noor14:00 -> 18:00
Ishan18:00 -> 22:00
Leah22:00 -> 02:00
Waiting
Automation

Automation handles the routine. Humans handle the judgment.

The lifecycle automates what policy can decide. When context requires human judgment—sensitive resources, unusual requests, escalated risk—the system routes to the right person with everything they need to decide.

Policy-Driven Routing

Requests automatically route to the right reviewer based on resource sensitivity, requester context, and policy rules. No manual triage.

Time-Bounded Grants

Every access grant carries an expiry timestamp. Duration limits come from policy, not human memory. No more forgotten standing access.

Approval Orchestration

Chains derive from org structure. Manager approval, owner approval, or both—policy decides. Approvers get context, not just a yes/no button.

Automatic Revocation

When grants expire, access is revoked. Not a reminder—actual removal from downstream systems. The lifecycle completes without manual intervention.

Lifecycle Analytics

Track every route through the JIT lifecycle.

See where policy auto-routes cleanly, which managers are carrying the longest queues, and which grants will expire on time before they harden into standing access.

FIG. 2.2

Zoth lifecycle analytics showing approval chains, routing patterns, and timing

Every request has a deterministic state. Requests transition through well-defined states, each transition emits an event. Approvers, auditors, and downstream systems can subscribe to state changes and act accordingly.