Skip to main content
See also: Just-in-Time (JIT) Access Requests — grant time-boxed access to a resource instead of approving each command.

​
What You’ll Accomplish

Action Access Requests require approval for each command before it executes. Unlike JIT Access Requests (which grant time-based access), Action requests give you command-level control:
  • Review the exact query before it runs
  • Approve or modify commands in real-time
  • Block dangerous operations even from authorized users
  • Create an audit trail of every approved action
The key difference from JIT Access Requests: Action requires approval for each command. JIT grants a time window where all commands are allowed.

​
How It Works

1

User Submits Command

User runs a command through Hoop (CLI, Web App, or API)
2

Command Held

Hoop holds the command and creates an access request with status PENDING
3

Approvers Notified

Designated approvers receive a notification (Slack, Teams, or Web App)
4

Approver Reviews

Approver sees the exact command and can:
  • Approve - Execute the command as-is
  • Reject - Block the command
5

Command Executes

If approved, the command runs and results are returned to the user

​
What the User Sees

$ hoop exec prod-db -i "UPDATE users SET status = 'inactive' WHERE id = 123"
⣷ Waiting for approval...
The command waits until an approver takes action.

​
What the Approver Sees

In Slack (or Teams): 
🔔 Access Request from alice@company.com

Resource Role: prod-db
Command: UPDATE users SET status = 'inactive' WHERE id = 123

[Approve] [Reject]

​
Use Cases

​
1. Production Database Changes

Every write operation on production is reviewed before it runs:
  • A developer submits a command that updates production data
  • The request pauses and notifies the DBA group for approval
  • The DBA reviews the exact statement before it executes
  • The command only runs once it’s approved

​
2. Dangerous Commands

High-risk operations are caught before they can cause damage:
  • An engineer submits a destructive command, such as a bulk delete
  • The request is held and routed to the security team
  • The security team verifies the scope and conditions are correct
  • The command is approved or denied based on what they see

​
3. Junior Developer Oversight

Junior team members get their commands reviewed:
  • Configure juniors’ group to require approval
  • Senior team members’ group can approve
  • Learning opportunity for juniors to see corrections

​
4. Compliance Requirements

Some regulations require dual approval for data access:
  • Configure multiple approval groups
  • Both groups must approve before execution
  • Full audit trail for compliance reporting

​
Comparison: Action vs JIT

AspectActionJIT
Approval scopeEach commandTime window
User experienceWait for each commandRequest once, run freely
Security levelHighestHigh
Use caseWrite operations, sensitive queriesRead access, debugging sessions
Approver loadHigher (more requests)Lower (one per session)

​
When to Use Action

  • Production write operations (UPDATE, DELETE, INSERT)
  • Sensitive data access
  • Compliance-required dual approval
  • Training/oversight scenarios

​
When to Use JIT

  • Debugging sessions (many queries)
  • Read-only access
  • On-call access
  • Time-limited elevated access

​
Best Practices

Clear Policies

Document which commands need approval and why

Fast Approvers

Have approvers available during work hours

Backup Approvers

Configure multiple approvers for coverage

Reasonable Timeouts

Set timeouts based on operational needs

​
For Approvers

  1. Review carefully - Check the exact command being run
  2. Verify context - Who is running it and why
  3. Respond quickly - Don’t leave requesters waiting
  4. Document rejections - Explain why if you reject
Ready to set it up? See the Action Access Requests Configuration guide for step-by-step instructions, approval group options, timeout settings, and notification setup.

​
Next Steps

JIT Access Requests

Time-based access for debugging sessions

Configuration Guide

Detailed configuration options

Slack Integration

Set up Slack notifications

Guardrails

Block dangerous commands automatically