> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.hoop.dev/docs/llms.txt > Use this file to discover all available pages before exploring further. # Action Access Requests > Require approval for individual commands before they execute export const ActionAccessAnimation = () => { const ESPRESSO = "var(--gradient-dark-mid)"; const WARM_GOLD = "var(--warm-gold)"; const SAND_100 = "var(--sand-100)"; const SAND_300 = "var(--sand-300)"; const SAND_500 = "var(--sand-500)"; const FONTS = `@import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500&family=Inter:wght@400;500;600;700;800&display=swap');`; const sleep = ms => new Promise(r => setTimeout(r, ms)); function useTypingText(text, speed, trigger) { const [displayed, setDisplayed] = useState(""); const [done, setDone] = useState(false); useEffect(() => { if (!trigger) { setDisplayed(""); setDone(false); return; } setDisplayed(""); setDone(false); let i = 0; const iv = setInterval(() => { i++; setDisplayed(text.slice(0, i)); if (i >= text.length) { clearInterval(iv); setDone(true); } }, speed); return () => clearInterval(iv); }, [trigger, text, speed]); return { displayed, done }; } const Cursor = ({visible = true}) => ; const StepIndicator = ({steps, activeStep}) =>
{steps.map((s, i) => { const isActive = i === activeStep; const isPast = i < activeStep; return
{isPast ? : i + 1}
{i < steps.length - 1 &&
}
; })}
; const [phase, setPhase] = useState("idle"); const [typingTrigger, setTypingTrigger] = useState(0); const [slackVisible, setSlackVisible] = useState(false); const [approveClicked, setApproveClicked] = useState(false); const [resultTrigger, setResultTrigger] = useState(0); const [activeStep, setActiveStep] = useState(-1); const [pendingVisible, setPendingVisible] = useState(false); const [approvedLine, setApprovedLine] = useState(false); const [showResult, setShowResult] = useState(false); const [fade, setFade] = useState(true); const running = useRef(false); const COMMAND = `UPDATE users SET status = 'inactive' WHERE id = 123`; const RESULT_TEXT = `UPDATE 1\n\n1 row affected.`; const commandTyping = useTypingText(COMMAND, 38, typingTrigger); const resultTyping = useTypingText(RESULT_TEXT, 28, resultTrigger); async function runLoop() { if (running.current) return; running.current = true; while (running.current) { setPhase("idle"); setSlackVisible(false); setApproveClicked(false); setActiveStep(-1); setPendingVisible(false); setApprovedLine(false); setShowResult(false); await sleep(400); setFade(false); await sleep(500); setPhase("typing"); setActiveStep(0); setTypingTrigger(t => t + 1); await sleep(COMMAND.length * 38 + 500); setPhase("pending"); setActiveStep(1); setPendingVisible(true); await sleep(1400); setPhase("slack"); setActiveStep(2); setSlackVisible(true); await sleep(2000); setApproveClicked(true); await sleep(700); setPhase("approved"); setActiveStep(3); setPendingVisible(false); setApprovedLine(true); await sleep(800); setShowResult(true); setResultTrigger(t => t + 1); await sleep(RESULT_TEXT.length * 28 + 2800); setFade(true); await sleep(1200); } } useEffect(() => { runLoop(); return () => { running.current = false; }; }, []); const steps = ["Execute", "Review", "Approve", "Complete"]; const showCmdCursor = phase === "typing" && !commandTyping.done; const showResCursor = showResult && !resultTyping.done; return
{}
Action Access Requests
{}
{}
{}
{}
{[0, 1, 2].map(i =>
)} Terminal
{}
{}
$ hoop exec prod-db -i " {commandTyping.displayed} {showCmdCursor && } {commandTyping.done && commandTyping.displayed && "}
{} {pendingVisible &&
Waiting for approval...
} {} {approvedLine &&
Approved. Executing...
} {} {showResult && 
                      {resultTyping.displayed}{showResCursor && }
}
{}
{}
#
#access-requests just now
{}
Access Request from alice@company.com
Resource Role prod-db
Command UPDATE users SET status = 'inactive' WHERE id = 123
{}
{}
hoop.dev
; };
**See also:** [Just-in-Time (JIT) Access Requests](/learn/features/access-requests/jit) — grant time-boxed access to a resource instead of approving each command. ## What You'll Accomplish Action Access Requests require approval for each command before it executes. Unlike JIT Access Requests (which grant time-based access), Action requests give you command-level control: * Review the exact query before it runs * Approve or modify commands in real-time * Block dangerous operations even from authorized users * Create an audit trail of every approved action **The key difference from JIT Access Requests:** Action requires approval for each command. JIT grants a time window where all commands are allowed. *** ## How It Works User runs a command through Hoop (CLI, Web App, or API) Hoop holds the command and creates an access request with status PENDING Designated approvers receive a notification (Slack, Teams, or Web App) Approver sees the exact command and can: * **Approve** - Execute the command as-is * **Reject** - Block the command If approved, the command runs and results are returned to the user ### What the User Sees ```bash theme={"dark"} $ hoop exec prod-db -i "UPDATE users SET status = 'inactive' WHERE id = 123" ⣷ Waiting for approval... ``` The command waits until an approver takes action. ### What the Approver Sees In Slack (or Teams): ``` 🔔 Access Request from alice@company.com Resource Role: prod-db Command: UPDATE users SET status = 'inactive' WHERE id = 123 [Approve] [Reject] ``` *** ## Use Cases ### 1. Production Database Changes Every write operation on production is reviewed before it runs: * A developer submits a command that updates production data * The request pauses and notifies the DBA group for approval * The DBA reviews the exact statement before it executes * The command only runs once it's approved ### 2. Dangerous Commands High-risk operations are caught before they can cause damage: * An engineer submits a destructive command, such as a bulk delete * The request is held and routed to the security team * The security team verifies the scope and conditions are correct * The command is approved or denied based on what they see ### 3. Junior Developer Oversight Junior team members get their commands reviewed: * Configure juniors' group to require approval * Senior team members' group can approve * Learning opportunity for juniors to see corrections ### 4. Compliance Requirements Some regulations require dual approval for data access: * Configure multiple approval groups * Both groups must approve before execution * Full audit trail for compliance reporting *** ## Comparison: Action vs JIT | Aspect | Action | JIT | | ------------------- | ----------------------------------- | ------------------------------- | | **Approval scope** | Each command | Time window | | **User experience** | Wait for each command | Request once, run freely | | **Security level** | Highest | High | | **Use case** | Write operations, sensitive queries | Read access, debugging sessions | | **Approver load** | Higher (more requests) | Lower (one per session) | ### When to Use Action * Production write operations (UPDATE, DELETE, INSERT) * Sensitive data access * Compliance-required dual approval * Training/oversight scenarios ### When to Use JIT * Debugging sessions (many queries) * Read-only access * On-call access * Time-limited elevated access *** ## Best Practices Document which commands need approval and why Have approvers available during work hours Configure multiple approvers for coverage Set timeouts based on operational needs ### For Approvers 1. **Review carefully** - Check the exact command being run 2. **Verify context** - Who is running it and why 3. **Respond quickly** - Don't leave requesters waiting 4. **Document rejections** - Explain why if you reject *** Ready to set it up? See the [Action Access Requests Configuration](/setup/configuration/access-requests/action-configuration) guide for step-by-step instructions, approval group options, timeout settings, and notification setup. ## Next Steps Time-based access for debugging sessions Detailed configuration options Set up Slack notifications Block dangerous commands automatically