Just-in-time privileged access
The Safe-Conduct
The Safe-Conduct hands out privilege the way a gate hands out passes: temporarily. Write down what you need, why, and for how long (with a ticket if your workspace requires one). A named approver who is not you clears it — one approver by default, two if you require it. You then get a time-boxed pass that grants exactly the resources you asked for, revokes itself when the window ends, and records everything it touched in the audit trail: who asked, who approved, what opened, when it closed. If a project is on fire, break-glass requests still work — they just carry an automatic review after the fact. Honest limits, stated plainly: this is not a privileged access management product — no credential vaulting, no recorded sessions, no proxy in front of your SSH. It is a documented, expiring grant on top of Palace roles, not a standing admin key with a polite label. Included on every Zipper plan.
Cloudflare analogue: just-in-time privileged access
What it is
The Safe-Conduct hands out privilege the way a gate hands out passes: temporarily. Write down what you need, why, and for how long (with a ticket if your workspace requires one). A named approver who is not you clears it — one approver by default, two if you require it. You then get a time-boxed pass that grants exactly the resources you asked for, revokes itself when the window ends, and records everything it touched in the audit trail: who asked, who approved, what opened, when it closed. If a project is on fire, break-glass requests still work — they just carry an automatic review after the fact. Honest limits, stated plainly: this is not a privileged access management product — no credential vaulting, no recorded sessions, no proxy in front of your SSH. It is a documented, expiring grant on top of Palace roles, not a standing admin key with a polite label.
Closest analogue: just-in-time privileged access. SLA 99.99% · p99 40ms. Requesters ask. Named approvers decide — never themselves. Admins set windows and approval counts.
- ▸Justification required on every request
- ▸Named approval — never self-approve
- ▸Pass expires itself; no standing admin keys
- ▸Scoped to named resources, not whole roles
- ▸Break-glass with automatic after-review
- ▸Full ask / approve / open / close audit trail
How it works
An elevation starts as a request: what access, why, for how long — plus a ticket reference if your workspace requires one. Justification is always required.
A named approver who is not you clears it (two if you require it). You can never approve your own request.
Clearance mints a time-boxed pass scoped to the resources you named — not a whole role — and the pass revokes itself when the window ends.
While it is open, everything the pass touches lands in the audit trail: who asked, who approved, what opened, when it closed.
Break-glass still works when a project is on fire; it simply carries an automatic after-the-fact review. Honest limits: no credential vaulting and no session recording — this is a documented, expiring grant on Palace roles.
Use cases
Concrete ways teams use this service on day one.
Give a contractor an hour of access
A contractor needs to tune WAF rules tonight without becoming a permanent admin.
- The contractor requests a pass: security services, sixty minutes, reason and ticket attached.
- A named steward approves — never the requester themselves.
- The pass opens on schedule, expires by itself, and leaves ask/approve/open/close in the audit log.
Replace standing admin keys
A team shares one always-on admin credential and cannot say who did what.
- Turn on justification and set the maximum elevation window.
- Require two approvals for production projects.
- Retire the shared key; every elevated action now carries a person, a reason, and an expiry.
Set it up in the dashboard
Dashboard → Identity & Access → The Safe-Conduct → Requests: open asks with justification and ticket.
Approvals: decide with the full context — requester, scope, window, and history of past grants.
Passes: live elevations with countdowns and the resources each one holds.
Audit: ask / approve / open / close, filterable by person and resource.
Configure: max window, approval count, break-glass review (justification, auto-revoke, and audit are always on).
API
Control-plane: GET|PATCH /api/v1/services/safeconduct. Send Authorization: Bearer tz_live_YOUR_TOKEN.
Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.
Read Safe-Conduct policy
curl -sS https://tinyzipper.com/api/v1/services/safeconduct \ -H "Authorization: Bearer tz_live_YOUR_TOKEN"
Tighten the elevation window and require two approvals
curl -sS -X PATCH https://tinyzipper.com/api/v1/services/safeconduct \
-H "Authorization: Bearer tz_live_YOUR_TOKEN" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"maxElevationMinutes":30,"approvalsRequired":2}'List the same resource in JavaScript
const res = await fetch("https://tinyzipper.com/api/v1/services/safeconduct", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
"Content-Type": "application/json"
}
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);Tips
You can never approve your own request — design teams so a second named person always exists.
Scope passes to named resources instead of whole roles; shorter windows are safer windows.
Break-glass is not a loophole: it records everything and queues an automatic review.
Not a PAM product — no credential vaulting, no session recording, no SSH proxy.
Pair with The Chancery’s access reports to see who still holds standing access.
- ▸SOC 2
- ▸Just-in-time elevation
- ▸Full audit trail
Runbook
A pass starts as a request: what, why, for how long, plus a ticket if your workspace requires one. A named approver who is not the requester clears it — two if you require it. The pass is scoped to named resources, expires on its own, and records everything it touched. Break-glass works and queues an after-review. No credential vaulting and no session recording.
Next: Edge Functions · All docs · Create a free account