# Workflow — Access Request & Provisioning Agent

## 1. 1. Validate the request

Capture the requester, resource, level, and justification, and resolve identity (role, dept, manager).

## 2. 2. Check entitlement policy

Look up the role-based policy for the requested access and determine whether it's standard or an exception.

## 3. 3. Run separation-of-duties

Compare against existing access for toxic combinations; a conflict blocks auto-provisioning.

## 4. 4. Score access risk

Rate privilege, data sensitivity, production scope, and blast radius to choose the path.

## 5. 5. Verify approvals

Confirm required approvals and justification exist; missing approval means request-info or escalate, never grant.

## 6. 6. Provision or escalate

Auto-provision only standard, low-risk, role-appropriate access (least-privilege, time-bound if possible); escalate privileged/sensitive/SoD cases.

## 7. 7. Audit

Log every decision with the policy basis, approvals, and risk rationale for review and access certification.
