🖐️Requesting Access

This page describes how to make a just-in-time access request using P0

Here we'll walk you through the life-cycle of an access request:

• 👋 Creating a request

• 🗣️ Discussing your request with approvers

• ▶️ Gaining access

• ⏏️ Relinquishing access and access expiration

👋 Creating a request

To begin, you'll use Slack to create an access request. You can either:

• Use an interactive modal

• Use slash commands

Using the Slack request modal

You can make requests using an interactive modal. This will help you discover what resources and possible access modes you can request.

Opening the modal

To open the modal, you can either:

• Type /p0 request in any Slack channel

• Click the "Run Shortcut" icon in the message draft bar, then search for and select "Request access"

Making your request

Choose a resource and access type, then fill out the remaining fields. You may skip optional fields.

The "reason" field is optional, but highly recommended. Filling this out will help your request be approved more easily.

Once you've filled out all required fields, click "Done". P0 will then send you a DM with details of your request.

Using Slack slash commands

If you already know exactly what you need access to, you can use slash commands to make requests more quickly.

Slash-command format

All slash commands start with /p0. You can always use --help to get help for your current command.

Request modal shortcut

You can open the interactive modal by typing an incomplete slash command. For example, /p0 request aws policy will open a partially filled AWS user-policy request. Add --help to force P0 to show you how to complete the slash command.

Creating requests

Using a complete slash command will generate an access request. For instance: /p0 request gcloud role p0-demo viewer --reason 'showing off P0' will create a new access request to gain the "Viewer" role on a p0-demo Google Cloud project.

After a successful request command, P0 will send you a DM with details of your request.

🗣️ Discussing your request

After your request is made, a message will be sent in your public P0 approval channel, asking for approval.

Your approver may immediately grant or deny your request, or respond in a thread to your request, asking for more information about why you're requesting access.

You cannot approve nor deny your own requests, unless you are a configured approver and your organization allows one-party approvals.

If your organization has configured automatic approvals and you meet the approval conditions (for example, you are on-call on a specified PagerDuty escalation policy), you will automatically be granted access for one hour.

▶️ Gaining access

After your request is approved, P0 will provision access for you, then notify you after provisioning is complete.

Note that you may have to wait an additional amount of time before your access is ready to use. This is because IAM resources have a propagation time in-between when access is configured and when access is usable. Observed propagation times are approximately:

System	Time-to-use
AWS	10 seconds - 15 seconds
Directories (Okta, Entra ID, Workspace)	Depends on SCIM propagation time
Google Cloud	30 seconds - one minute
PostgreSQL	Immediate
Snowflake	Immediate

⏏️ Access relinquishment and expiration

When your access was approved, your approver defined how long your access would last. Once your access expires, P0 will automatically remove it. If you still need this access, you can re-request it.

If you finish using your access before your access expires, you can also choose to relinquish your access. Click the "Relinquish" button to give up access early. This can help you avoid using your access unintentionally.