Action Access Requests - Hoop.dev - Automated Access and Data Protection

What You’ll Accomplish

Action Access Requests require approval for each command before it executes. Unlike JIT Access Requests (which grant time-based access), Action requests give you command-level control:

Review the exact query before it runs
Approve or modify commands in real-time
Block dangerous operations even from authorized users
Create an audit trail of every approved action

The key difference from JIT Access Requests: Action requires approval for each command. JIT grants a time window where all commands are allowed.

How It Works

User Submits Command

User runs a command through Hoop (CLI, Web App, or API)

Command Held

Hoop holds the command and creates an access request with status PENDING

Approvers Notified

Designated approvers receive a notification (Slack, Teams, or Web App)

Approver Reviews

Approver sees the exact command and can:

Approve - Execute the command as-is
Reject - Block the command

Command Executes

If approved, the command runs and results are returned to the user

What the User Sees

$ hoop exec prod-db -i "UPDATE users SET status = 'inactive' WHERE id = 123"
⣷ Waiting for approval...

The command waits until an approver takes action.

What the Approver Sees

In Slack (or Teams):

🔔 Access Request from alice@company.com

Connection: prod-db
Command: UPDATE users SET status = 'inactive' WHERE id = 123

[Approve] [Reject]

Quick Start

Prerequisites

To get the most out of this guide, you will need to:

Either create an account in our managed instance or deploy your own hoop.dev instance
You must be your account administrator to perform the following actions

A connection configured with an agent
At least one user group for approvers
(Optional) Slack or Teams integration

Step 1: Enable Action Access Requests

Navigate to Connection Settings

Go to Connections and select your connection

Open Additional Configuration

Click the Additional Configuration tab

Enable Access Requests

Toggle on Access Requests

Select Approval Groups

Choose which groups can approve commands

Save

Click Save to apply changes

Step 2: Test the Workflow

As a non-admin user, run a command:

hoop exec prod-db -i "SELECT COUNT(*) FROM users"

You should see:

⣷ Waiting for approval at https://use.hoop.dev/access-requests/abc123...

Step 3: Approve the Command

As an approver: Option A: Via Slack

Find the notification in your Slack channel
Review the command
Click Approve

Option B: Via Web App

Go to Access Requests in the sidebar
Find the pending request
Review the command details
Click Approve or Reject

Step 4: Command Executes

Once approved, the user’s terminal shows the results:

count
-------
 12345
(1 row)

Configuration Options

Approval Groups

Configure which groups can approve commands:

Configuration	Behavior
Single group (`dba-team`)	Any member of `dba-team` can approve
Multiple groups (`dba-team`, `security`)	One member from each group must approve

Groups Requiring Approval

Configure which groups need their commands approved:

Setting	Behavior
All users	Every command requires approval
Specific groups	Only commands from those groups need approval
Exempt groups	Some groups (like `admin`) bypass approval

Request Timeout

Set how long to wait for approval before the request expires:

Setting	Use Case
5 minutes	Quick ad-hoc queries
30 minutes	Standard operations
1 hour	Complex procedures

Use Cases

1. Production Database Changes

All write operations on production require approval:

# This will wait for approval
hoop exec prod-db -i "UPDATE orders SET status = 'shipped' WHERE id = 123"

The DBA reviews the exact UPDATE statement before it runs.

2. Dangerous Commands

Block risky operations unless approved:

# This will definitely need approval
hoop exec prod-db -i "DELETE FROM logs WHERE created_at < '2024-01-01'"

Security team can verify the WHERE clause is correct.

3. Junior Developer Oversight

Junior team members get their commands reviewed:

Configure juniors’ group to require approval
Senior team members’ group can approve
Learning opportunity for juniors to see corrections

4. Compliance Requirements

Some regulations require dual approval for data access:

Configure multiple approval groups
Both groups must approve before execution
Full audit trail for compliance reporting

Integration Options

Slack

Receive and approve commands directly in Slack:

Set up Slack integration
Configure notification channel
Approvers click buttons to approve/reject

Microsoft Teams

Same workflow in Teams:

Set up Teams integration
Configure webhook URL
Notifications appear in your channel

Webhooks

For custom integrations:

Configure a webhook endpoint
Receive POST requests for new access requests
Call the API to approve/reject

Comparison: Action vs JIT

Aspect	Action	JIT
Approval scope	Each command	Time window
User experience	Wait for each command	Request once, run freely
Security level	Highest	High
Use case	Write operations, sensitive queries	Read access, debugging sessions
Approver load	Higher (more requests)	Lower (one per session)

When to Use Action

Production write operations (UPDATE, DELETE, INSERT)
Sensitive data access
Compliance-required dual approval
Training/oversight scenarios

When to Use JIT

Debugging sessions (many queries)
Read-only access
On-call access
Time-limited elevated access

Troubleshooting

Command Times Out

If the command expires before approval: Check:

Approvers received the notification
Slack/Teams integration is working
Request timeout is long enough

Solutions:

Increase timeout in connection settings
Verify notification channel configuration
Add more approvers for faster response

Approver Can’t See Request

Check:

Approver is in an approval group
Approver has subscribed to notifications (/hoop subscribe in Slack)
Notification channel is configured

Admin Users Bypass Approval

This is expected—admin users auto-approve their own requests. To test the full workflow:

Use a non-admin test account
Or temporarily remove yourself from admin group

Request Shows “Rejected” But Shouldn’t

Check the rejection reason:

Go to Access Requests in Web App
Find the rejected request
Click to see who rejected and why

Best Practices

Clear Policies

Document which commands need approval and why

Fast Approvers

Have approvers available during work hours

Backup Approvers

Configure multiple approvers for coverage

Reasonable Timeouts

Set timeouts based on operational needs

For Approvers

Review carefully - Check the exact command being run
Verify context - Who is running it and why
Respond quickly - Don’t leave requesters waiting
Document rejections - Explain why if you reject

Next Steps

JIT Access Requests

Time-based access for debugging sessions

Configuration Guide

Detailed configuration options

Slack Integration

Set up Slack notifications

Guardrails

Block dangerous commands automatically

Introduction

Features

Clients

Quickstart

Setup & Administration

Concepts

Integrations

​What You’ll Accomplish

​How It Works

​What the User Sees

​What the Approver Sees

​Quick Start

​Prerequisites

​Step 1: Enable Action Access Requests

​Step 2: Test the Workflow

​Step 3: Approve the Command

​Step 4: Command Executes

​Configuration Options

​Approval Groups

​Groups Requiring Approval

​Request Timeout

​Use Cases

​1. Production Database Changes

​2. Dangerous Commands

​3. Junior Developer Oversight

​4. Compliance Requirements

​Integration Options

​Slack

​Microsoft Teams

​Webhooks

​Comparison: Action vs JIT

​When to Use Action

​When to Use JIT

​Troubleshooting

​Command Times Out

​Approver Can’t See Request

​Admin Users Bypass Approval

​Request Shows “Rejected” But Shouldn’t

​Best Practices