Customer Snapshot
| Attribute | Details |
|---|---|
| Industry | Technology / AI SaaS |
| Cloud Environment | AWS (4 accounts: 1 Dev & Management, 3 Production) |
| Team Size | ~150 users across global timezones |
| Approver Model | 2 approvers from 2 regions covering the globe |
| Identity Provider | Google Workspace → AWS IAM Identity Center |
| Communication | Slack |
| Challenge | Access blocked when either approver is unavailable |
| Cloudanix Scope | Cloud Console JIT with Approval Delegation |
The Situation: Two Approvers, Two Regions, Zero Redundancy
When this AI SaaS company adopted Just-In-Time access, they configured two approvers — one covering APAC/EMEA hours, one covering Americas hours. Between them, they provided ~18 hours of daily coverage for access requests. In practice, this worked well: engineers requested access via Slack, the appropriate regional approver responded within minutes, and access was granted.
Until one of them took a week off.
The moment either approver was unavailable — vacation, sick leave, offsite meetings, personal emergencies — the entire access workflow for their timezone window stalled. Engineers who needed production access during those hours had no one to approve their requests. The workaround was predictable: pre-grant broad access before the approver left, “just in case.” Which is to say, revert to standing privilege whenever the JIT workflow couldn’t function.
The team didn’t need more permanent approvers. They needed a mechanism to temporarily delegate approval authority — with time bounds, audit trails, and automatic expiry — so that JIT continued working even when the primary approvers were unavailable.
The Core Challenge
A JIT system that requires human approval is only as available as its human approvers. With two approvers covering the globe, any unavailability creates a binary choice: block engineers or bypass JIT. Neither is acceptable. The team needed delegation that is temporary, auditable, and self-revoking.
Where the Gaps Were
Approver Availability Is the New Single Point of Failure
Replacing a manual access workflow with JIT solved the single-approver-bottleneck problem — but only partially. The underlying dependency on specific humans remained:
- Vacation planning required pre-granting. Before approvers left for time off, the team would pre-approve broad access for engineers who “might need something.” This preemptive granting defeated the entire purpose of JIT — access existed without a specific need, without time bounds, and without the audit trail of a real request.
- Sick days broke the workflow. Unplanned absences had no workaround. Engineers waited, escalated to other teams, or found alternative paths that bypassed JIT entirely.
- Meeting blocks created micro-outages. An approver in a 2-hour all-hands meeting meant 2 hours where their timezone’s engineers couldn’t get production access. Not a crisis for planned work, but critical for incident response.
- No escalation path. When the primary approver was unavailable, there was no automatic fallback. Requests sat in Slack unanswered until someone noticed and found an alternative human to approve manually.
Adding More Permanent Approvers Creates New Problems
The obvious solution — “just add more approvers” — creates its own issues:
- Approval fatigue. More approvers means each person approves more requests, but each request matters less to them. Review quality degrades when approval becomes a frequent interruption rather than a meaningful security decision.
- Diffusion of responsibility. When five people can approve, each assumes someone else will handle it. Response times can actually increase with more approvers.
- Broader access to approval context. Not everyone should have ongoing visibility into all access requests across all teams. Permanent approver status means permanent visibility into request patterns, team access needs, and infrastructure details that may not be appropriate for a temporary backup.
- No time-bounding. Once someone is an approver, they’re an approver permanently until manually removed. There’s no concept of “you’re the backup for this week only.”
The Pre-Granting Antipattern
When JIT isn’t available due to approver absence, teams revert to standing access. The conversations follow a predictable pattern:
“I’m off next week. Let me grant everyone ReadOnly on production just in case someone needs to debug something.”
This single sentence undoes weeks of JIT discipline. Five engineers now have standing production access for seven days — not because they need it now, but because they might need it while the approver is gone. And in practice, those grants often aren’t revoked when the approver returns because there’s no reminder system triggering revocation.
The pre-granting antipattern turns every vacation into a standing-privilege expansion event.
The Cloudanix Solution: Time-Bound Approval Delegation
Cloudanix addresses this with Approval Authority Delegation — a mechanism that allows a primary approver to temporarily assign their approval authority to a designated backup, with explicit time bounds and automatic expiry.
How Delegation Works
-
Primary approver selects a delegate. Before going on leave (or during an unplanned absence, configured by an admin), the approver designates who will handle approvals in their absence.
-
Duration is set explicitly. “Delegate to [backup person] from Monday 9am to Friday 5pm.” The delegation is time-bound from the start — not open-ended.
-
Delegate receives approval notifications. During the delegation window, access requests that would normally route to the primary approver route to the delegate instead. Same Slack buttons, same approval context, same one-click workflow.
-
Delegation auto-expires. When the configured duration ends, the delegation disappears automatically. The delegate loses approval authority without anyone needing to remember to revoke it. The primary approver resumes receiving requests.
-
Full audit trail. Every approval made by a delegate is logged as such: “Approved by [delegate] on behalf of [primary approver], delegation active [date range].” Compliance teams can see exactly who approved what and under what authority.
Why Time-Bounding the Delegation Matters
The delegation mechanism mirrors JIT’s core principle: access exists only when needed, for as long as needed, and revokes automatically.
- No permanent backup approvers. The delegate has approval authority for the vacation week only. They don’t accumulate ongoing visibility into all access requests across the organisation.
- No forgotten delegations. If the approver forgets to revoke the delegation when they return (which happens), the system does it automatically at the configured expiry.
- Scoped by the primary approver’s authority. The delegate inherits only what the primary approver could approve. If the primary approver handles engineering access requests for one team, the delegate handles those same requests — not all access across the organisation.
Complementing Multi-Level Approval
For teams with multi-level approval configured (auto-approve for read-only, one approver for staging, two approvers for production admin), delegation works at each level:
- Level 1 (auto-approve) doesn’t need delegation — it’s policy-driven with no human in the loop.
- Level 2 (single approver) benefits most from delegation. The one person who needs to approve can delegate to a backup during absence.
- Level 3 (multiple approvers) has natural redundancy when more than one approver is configured. Delegation becomes relevant only if all approvers at that level are unavailable simultaneously.
The delegation model ensures that even with the most restrictive approval requirements (production admin access requiring specific human judgment), the workflow doesn’t stall when the designated human is temporarily unavailable.
Platform Impact
| Scenario | Before Delegation | After Delegation |
|---|---|---|
| Approver on vacation (1 week) | Pre-grant standing access to “just in case” | Delegate handles requests normally; JIT continues |
| Approver in all-day meetings | Requests queue for hours | Delegate responds in real time |
| Unplanned sick day | Engineers blocked until someone escalates | Admin activates delegation; workflow resumes |
| Approver leaves the company | Manual reassignment of all approval roles | Delegation covers the gap while permanent transfer is arranged |
| Weekend incident, approver offline | Incident responders wait or bypass JIT | On-call delegate approves immediately |
The Broader Access Governance Design
Approval delegation is one component of a broader access governance model that accounts for real-world operational patterns:
- Auto-approval handles the low-risk, high-frequency requests (read-only, development) without any human involvement.
- Standard approval handles the moderate-risk requests (edit access, staging environments) with a single approver.
- Multi-level approval handles the high-risk requests (production admin, cluster-admin) with multiple approvers at different levels.
- Delegation ensures that the human-dependent parts of this model (standard and multi-level approval) don’t become unavailability bottlenecks.
Together, these mechanisms ensure that access is governed proportionally to risk — and that governance doesn’t break down because humans have schedules, vacations, and unexpected absences.
Running JIT with a Small Approver Pool?
If your access approval workflow depends on one or two specific people, and you’ve experienced the “approver on vacation” problem — pre-granting access, blocked engineers, or JIT bypasses — Cloudanix’s delegation model ensures your JIT governance continues uninterrupted regardless of approver availability. Time-bound, audited, and self-revoking — matching the same principles that govern the access itself.
Book a Free Assessment to see how JIT approval delegation works alongside auto-approval policies and multi-level approval for your team structure.
