For the complete documentation index, see llms.txt. This page is also available as Markdown.

πŸ–οΈRequesting Access

Request just-in-time access to cloud resources using P0.

Need temporary access to a cloud resource? P0 lets you request time-limited access that's automatically provisioned after approval and revoked when it expires.

You can request access through any of these methods:

Method
Best for
Details

Slack

Quick requests when you already use Slack

Microsoft Teams

Quick requests when you already use Teams

Web app

Browser-based requests without Slack or Teams

CLI

Terminal workflows and automation

How access requests work

  1. You request access to a specific resource, role, or permission.

  2. P0 routes the request to the appropriate approver based on your organization's policies.

  3. An approver reviews and approves (or denies) the request.

  4. P0 provisions access automatically and notifies you.

  5. Access expires after the approved duration, or you relinquish it early.

Most IAM systems have a propagation delay of 10-60 seconds after access is provisioned before you can use it.

Request via Slack

If your organization has installed the Slack integration, you can request access directly from Slack.

Using the Slack request modal

Open the interactive modal to discover available resources and access modes:

  • Type /p0 request in any Slack channel

  • Or click the Run Shortcut icon in the message draft bar, then search for and select Request access

Select a resource and access type, then fill out the remaining fields. You may skip optional fields.

The "reason" field is optional, but highly recommended. Filling this out helps your request get approved more quickly.

Once you've filled out all required fields, click Request. P0 then sends you a DM with details of your request.

Using Slack slash commands

If you already know what you need, use slash commands for faster requests:

Add --help to any command to see available options. You can also type an incomplete command (for example, /p0 request aws policy) to open a filled modal.

Request via Microsoft Teams

If your organization has installed the Microsoft Teams integration, you can request access by messaging the P0 Security bot directly in Teams.

Sending a request message

Open a direct message with the P0 Security bot and type your request. For example:

The bot presents an interactive card where you can fill in resource details, select an access type, and submit your request.

Supported commands

You can use the following commands when messaging the P0 Security bot:

Command
Purpose

request

Request access to a resource

ls

List available resources

help

Display available commands and usage

Type help to see the full list of available commands and options.

Request via the web app

  1. Open the P0 app and navigate to Access Management.

  2. Click Request Access in the header.

  3. Fill in the resource, role, duration, and reason.

  4. Submit for approval.

For a detailed walkthrough, see Web request modal.

Request via the CLI

The P0 CLI provides command-line access requests that integrate with your terminal workflow.

After installing and logging in, use these commands:

Command
Purpose

Request access to any supported resource

Request and assume an AWS IAM role

Request and assume an AWS Identity Center permission set

Request and establish an SSH session

Request Kubernetes access and configure kubeconfig

Use --wait with any request command to block until the system provisions access, then automatically execute the underlying tool command.

Discussing your request with approvers

After you submit a request, a message appears in your organization's P0 approval channel (in Slack or Microsoft Teams) asking for approval. Your approver may:

  • Approve or deny the request immediately

  • Respond in a thread to ask for more information

You can't approve your own requests unless you are a configured approver and your organization allows one-party approvals.

If your organization has configured automatic approvals and you meet the approval conditions (for example, you are on-call on a specified PagerDuty escalation policy), access is granted automatically.

Gaining access

After approval, P0 provisions access and notifies you. Propagation times vary by system:

System
Time to use

AWS

10-15 seconds

Directories (Okta, Entra ID, Workspace)

Depends on SCIM propagation time

Google Cloud

30 seconds - 1 minute

PostgreSQL

Immediate

Snowflake

Immediate

Relinquishing access

Access expires automatically after the approved duration. If you finish early, click the Relinquish button in your P0 notification (in Slack or Microsoft Teams) or on the Access Management page in the P0 app to give up access. This helps avoid unintentional use of elevated permissions.

Request on behalf of someone else

You can submit access requests for a colleague or service account. See Request for another party.

Last updated