# Access Request & Provisioning Agent

> An access-request agent that checks role policy and separation-of-duties, auto-provisions low-risk access, and escalates privileged or sensitive requests.

- **Category:** ITSM / Helpdesk
- **Difficulty:** Advanced
- **Setup time:** 50 min
- **Stacks:** Claude, LangGraph, OpenAI
- **Version:** 2.0.0 (updated 2026-06-21)
- **Source:** https://agent-kits.com/kit/access-request-handler

## Overview

Validate → policy-check → SoD → risk-score → provision or escalate: turns an access request into a safe, policy-grounded outcome.

Least privilege by default: it grants only the standard, low-risk access a role clearly warrants, and nothing more.

Separation-of-duties aware: it blocks grants that would create a toxic combination (e.g. create-vendor + approve-payment).

Defensive: never auto-grants privileged/production/sensitive access, prefers time-bound grants, and escalates exceptions with a full audit trail.

## When to use it

- Your IT/helpdesk queue is full of routine access requests that follow role-based policy.
- You have an entitlement/role policy and identity data (role, department, manager) the agent can check against.
- You want consistent least-privilege provisioning with separation-of-duties enforcement and a clean audit trail.
- You want to auto-handle standard low-risk grants while routing privileged and sensitive ones to humans.

## When not to use it

- You expect it to grant admin, production, or sensitive-data access autonomously — it must not.
- You have no role/entitlement policy for it to ground decisions in.
- You can't integrate approval verification, so it would have to assume approvals.
- You can't keep human review on privileged and exception requests.

## Architecture

- **Request intake** — Receives the access request (requester, resource, level, business justification) and normalizes it for evaluation.
- **Identity resolution** — Resolves the requester's role, department, and manager from the identity provider to ground the policy check.
- **Entitlement policy engine** — Looks up the role-based entitlement policy for the requested access and determines whether it's standard for that role or an exception.
- **Separation-of-duties check** — Compares the requested grant against the requester's existing access to detect toxic combinations that violate SoD.
- **Access-risk scoring** — Scores the request by privilege level, data sensitivity, production scope, and blast radius to decide the path.
- **Approval & provisioning gate** — A deterministic gate verifies required approvals and blocks auto-provisioning of privileged/sensitive/production access and SoD conflicts; only standard low-risk grants pass.
- **Provision & audit** — Grants least-privilege (time-bound where supported), or escalates, and writes a full audit record with the policy basis and approvals.

## Files in this bundle

- `system-prompt.md` — the agent's system prompt
- `tools.json` — tool/function definitions the agent expects
- `workflow.md` — step-by-step run loop
- `.env.example` — environment variables to fill in
- `kit.json` — full structured metadata
- `starters/` — minimal starter snippets
- `LICENSE` — Apache-2.0 (code, configuration, and schema)
- `LICENSE-CONTENT` — CC BY 4.0 (specification text and documentation)
- `NOTICE` — attribution and trademark notice
- `run.py` — **runnable demo**: real agent loop with mock tools (`pip install anthropic`, set `ANTHROPIC_API_KEY`, `python run.py`)
- `agentaz.json` / `agentaz.schema.json` — AgentAz™ governance spec + schema

## Implementation notes

- Default to least privilege and time-bound/just-in-time grants; standing privileged access is the thing this agent exists to avoid handing out.
- Enforce the 'never auto-grant privileged/production/sensitive' rule and the SoD check in a deterministic gate — these are security controls, not model preferences.
- Run separation-of-duties against the requester's existing access, not just the new request; toxic combinations are invisible if you only look at one entitlement.
- Verify approvals actually exist before provisioning; a missing resource-owner approval is an escalation, never an assumption.
- Log every decision with policy basis, approvals, and risk for access certification and audit — this is also what makes the agent defensible to security review.
- Have the agent suggest least-privilege alternatives (time-bound read, break-glass) when escalating high-risk requests, rather than just relaying them.
- Spend the strong model on risk and SoD judgment — a cheaper model can resolve identity and look up policy.

## Variations

- **Basic — Request triage assistant:** Validates the request, checks policy and separation-of-duties, scores risk, and recommends grant/escalate for an IT analyst. No autonomous provisioning.
- **Advanced — Guarded auto-provisioning:** Auto-provisions standard low-risk, role-appropriate access (least-privilege, time-bound) with approval verification, and escalates privileged/sensitive/SoD-conflict requests.
- **Enterprise — Governed access automation:** Adds IGA/IAM integration, role-mining and entitlement catalogs, JIT access, full audit and access-certification support, and policy tuning — privileged access always human-approved.

## FAQ

**Will it grant admin or production access automatically?**

Never. Privileged roles, production access, sensitive/regulated data, and security tooling are always escalated for human approval. It only auto-provisions standard, low-risk, role-appropriate access.

**How does it enforce least privilege?**

It grants the minimum access the role clearly warrants for the stated need — read instead of write where that suffices — and prefers time-bound/just-in-time grants over standing access, citing the policy basis each time.

**What is the separation-of-duties check?**

Before granting, it compares the request against the requester's existing access to catch toxic combinations (like create-vendor + approve-payment, or develop + deploy-to-prod). Any conflict blocks auto-provisioning and is escalated.

**Does it assume approvals are in place?**

No. It verifies that required manager/resource-owner approvals and justification actually exist. Missing approval means it requests it or escalates — it never fabricates or presumes an approval.

**Is there an audit trail?**

Yes. Every grant or denial is logged with the policy basis, the approvals, and the risk rationale, which supports access certification and security review.

**How do we roll it out safely?**

Start in advise mode where it recommends, backtest on past requests to confirm it never auto-grants privileged access or SoD conflicts, then enable auto-provisioning for standard low-risk requests.


---

© 2026 AgentKits · www.agent-kits.com

**Open source.** Code, configuration, and the AgentAz™ schema are licensed under
**Apache-2.0**; specification text and documentation under **CC BY 4.0** (with
attribution to AgentKits, link to https://www.agent-kits.com). See LICENSE, LICENSE-CONTENT,
and NOTICE in this bundle. "AgentAz" and "AgentKits" are trademarks of AgentKits.

**Flagship reference blueprint.** View the source, AgentAz™ spec, and frozen v1.0 schema
in the public registry: https://github.com/agent-kits/agentaz
Original: https://agent-kits.com/kit/access-request-handler
