{GATES.map(gate => {
const on = gate.at <= currentLayer;
return
{}
{ICONS[gate.id]}
{}
{gate.name}
{}
{gate.tag}
;
})}
{}
{}
{Array.from({
length: TOTAL
}, (_, i) => )}
{}
;
};
**See also:** [Action-based Access Requests](/learn/features/access-requests/action) — approve individual commands instead of granting time-boxed access.
## What You'll Accomplish
Just-in-Time (JIT) Access Requests let you grant temporary access to production resources with automatic expiration. Instead of giving permanent access, you can:
* Grant a developer 2 hours of database access for debugging
* Allow on-call engineers 8 hours of access during their shift
* Enable break-glass access for emergencies with full audit trail
* Reduce standing privileges by requiring approval for every access request
**The key difference from Action Access Requests:** JIT grants time-based access to a resource role. Once approved, the user can run any command within that time window. Action Access Requests require approval for each individual command.
***
## How JIT Access Requests Work
User runs `hoop connect --duration 2h` to request time-limited access
An access request is created with status **PENDING** and approvers are notified via Slack/Teams
Approver approves or rejects the request
If approved, user gets access for the requested duration. Access automatically expires when time runs out.
### Request Statuses
| Status | Description |
| ------------ | ------------------------------------------- |
| **PENDING** | Waiting for approval from designated groups |
| **APPROVED** | Access granted, user can connect |
| **REJECTED** | Access denied by an approver |
| **REVOKED** | Access withdrawn after initial approval |
| **EXECUTED** | Access period completed (expired) |
***
## Common Use Cases
### 1. Production Database Debugging
A developer needs to investigate a production issue:
```bash theme={"dark"}
# Request 1 hour of access
hoop connect prod-db --duration 1h
```
DBA approves via Slack. Developer runs diagnostic queries. Access expires automatically.
### 2. On-Call Access
On-call engineers get temporary elevated access during their shift:
```bash theme={"dark"}
# Request access for 8-hour shift
hoop connect all-prod-systems --duration 8h
```
### 3. Break-Glass Emergency Access
For urgent incidents, request immediate access with documentation:
```bash theme={"dark"}
# Emergency access with explicit duration
hoop connect critical-system --duration 30m
```
**Best practice:** Set up a dedicated `emergency-approvers` group with 24/7 availability.
### 4. Contractor Time-Limited Access
Grant temporary access for external contractors:
```bash theme={"dark"}
# Contractor requests access for their engagement period
hoop connect client-db --duration 4h
```
***
## Best Practices
Match access duration to task requirements. 2 hours for debugging, 8 hours for on-call shifts.
Require both technical and security approval for production databases.
Real-time notifications ensure fast approval turnaround.
Review access patterns in Sessions to identify unusual activity.
***
Ready to set it up? See the [JIT Access Requests Configuration](/setup/configuration/access-requests/jit-configuration) guide for creating the Access Request rule, approval groups, duration limits, and notifications.
## Next Steps
Approve individual commands instead of time-based access
Set up Slack for access request notifications
Audit what happened during approved sessions
Configure who can access which resource roles