# Setup guide — Access Request & Provisioning Agent

## 1. Install and connect IAM/ITSM

Install the agent and connect it to your identity provider and ticketing.

```
pipx install access-request-agent
access-request-agent connect --idp okta --itsm servicenow
access-request-agent doctor   # verifies least-privilege provisioning scope
```

## 2. Configure guardrails

What may auto-provision. Privileged/sensitive/production access never can. Enforced outside the model.

```
cp .env.example .env
ANTHROPIC_API_KEY=sk-ant-...
AUTO_PROVISION_ONLY: { risk: "low", role_standard: true, approvals: "present" }
NEVER_AUTO: ["admin", "production", "sensitive_data", "security_tooling"]
PREFER_TIME_BOUND=true
```

## 3. Load entitlement policy & SoD rules

Define standard role entitlements and the toxic combinations to block.

```
# access.yml
roles:
  engineer: { standard: ["repo:read", "ci:read", "dev-db:read"] }
sod_conflicts:
  - ["vendor:create", "payment:approve"]
  - ["code:develop", "prod:deploy"]
privileged: ["*:admin", "prod:*", "pii:*"]
```

## 4. Dry-run on past requests

Replay historical requests to confirm it never auto-grants privileged access or SoD conflicts.

```
access-request-agent backtest --range 60d --explain
# reports auto-provision/escalate decisions; privileged auto-grants must be 0
```

## 5. Wire into the request flow

Route access requests to the agent; privileged/sensitive/SoD requests auto-route to security.

```
# access request ticket -> POST https://your-host/access/handle (HMAC)
# decision=ESCALATE auto-assigns to the security queue
```
