mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

4.9 KiB

Raw Blame History

name

description

domain

subdomain

Implementing Just-In-Time Access Provisioning

Overview

Implement Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound access only when needed. This skill covers JIT architecture design, approval workflows, automatic expiration, integration with PAM and IGA platforms, and alignment with zero trust principles.

When to Use

When deploying or configuring implementing just in time access provisioning capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with identity access management concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Design JIT access request and approval workflows
Implement time-bound access grants with automatic expiration
Configure risk-based approval routing (auto-approve low-risk, multi-approval for high-risk)
Integrate JIT with PAM for privileged access elevation
Monitor and audit all JIT access grants and usage
Reduce attack surface by eliminating standing privileges

Key Concepts

JIT Access Models

Broker and Remove: Grant access through approval, auto-remove after time window
Elevation on Demand: User has base access, elevates to privileged upon request
Account Creation/Deletion: Temporary account created, destroyed after use
Group Membership Toggle: Add to privileged group temporarily, auto-remove

Zero Standing Privilege (ZSP) Principle

No user has permanent privileged access
All privileged access requires explicit request with business justification
Access automatically expires after defined time window
All access events logged and auditable

Workflow

Step 1: Identify Eligible Access Types

Privileged admin access (domain admin, root, DBA)
Production environment access
Sensitive data access (PII, financial, healthcare)
Emergency/break-glass access
Third-party vendor access

Step 2: Design Approval Workflows

Self-service request portal with justification requirement
Auto-approve for pre-authorized low-risk access (< 1 hour)
Single approver for medium-risk (manager or resource owner)
Dual approval for high-risk (manager + security team)
Emergency bypass with post-facto review

Step 3: Implement Time-Bound Access

Configure maximum access duration per resource type
Implement countdown timer with extension request capability
Auto-revoke at expiration regardless of session state
Grace period notification (15 min before expiry)
Automatic session termination on access expiry

Step 4: Integration Architecture

Connect to IAM/IGA platform for provisioning/de-provisioning
Integrate with PAM for privileged credential checkout
Connect to ITSM for ticket correlation
Forward events to SIEM for monitoring
API integration for programmatic access requests

Step 5: Monitoring and Compliance

Log all JIT requests, approvals, grants, and revocations
Alert on access used beyond approved scope
Track access not used (request but never connected)
Measure mean time to access (request to grant)
Report on access patterns for baseline optimization

Security Controls

Control	NIST 800-53	Description
Temporary Access	AC-2(2)	Automated temporary account management
Least Privilege	AC-6	Time-bound minimum access
Access Enforcement	AC-3	Automated access grant/revoke
Audit	AU-3	Complete JIT access audit trail
Risk Assessment	RA-3	Risk-based approval routing

Common Pitfalls

Setting time windows too long, negating JIT benefits
Not implementing automatic revocation at expiration
Complex approval workflows causing access delays for legitimate needs
Not providing emergency bypass for critical incidents
Failing to audit approved but unused JIT access

Verification

JIT request workflow functional end-to-end
Access automatically revoked at expiration
Approval routing correct for all risk levels
Emergency access bypass works with post-review
All JIT events logged to SIEM
Standing privileges reduced by measurable percentage
Mean time to access meets business SLA

4.9 KiB Raw Blame History