The worst part about managing access in a fast-moving stack isn’t the alerts or the dashboards. It’s the waiting. Waiting for someone to approve a debug session, waiting for VPN rules to refresh, waiting for the right role to sync. That’s where Clutch Zscaler comes in.
Clutch is Lyft’s open-source platform for safely automating operational workflows inside infrastructure. Zscaler provides secure, zero-trust access to internal apps without old-school network tunnels. Together, they strip friction out of the approval and access loop. In short, Clutch Zscaler means controlled production access that moves at the speed of your CI.
When these two tools work in sync, they become a dynamic gatekeeper. Clutch defines the logic of “who can do what” through service owners, RBAC, and audit trails. Zscaler enforces the network layer, authenticating identities through SSO or OIDC before any traffic flows. The path from request to access becomes almost invisible, but every decision is logged and tied to identity.
A typical integration starts with identity mapping through your IdP, such as Okta or Azure AD. Clutch triggers workflows that validate the requester’s role and time-bounded need, then instructs Zscaler to establish a session for that specific target—say, a staging database or Kubernetes dashboard. No long-lived keys, no static IP lists. Access expires automatically, leaving an audit trail clean enough for SOC 2 reviewers to smile at.
Before rolling this out, keep one best practice in mind: keep approval logic and enforcement logic separate. Let Clutch handle policy as code, and let Zscaler handle transport and encryption. This division keeps the system legible even for small ops teams and prevents one-off exceptions from sneaking into production.