What problem does it solve?
Informal "I need access to X" messages in Slack often turn into over-broad, untracked permission grants. This Skill turns each request into a scoped, policy-checked GitHub or AWS IAM grant that is held until an authorized approver signs off, and logs every applied grant for audit.
Core Features & Use Cases
- Policy-checked grant sizing: Looks up the requester's role, team, and manager in Okta (read-only) and maps the ask against a role-to-grant policy table, never defaulting to admin-level access.
- Approval handshake with guardrails: Posts the prepared grant in the request thread and applies it only after a fresh-verified approval from an authorized approver — never the requester themselves.
- Extra-scrutiny routing: Flags sensitive asks (admin permissions, AdministratorAccess, production data stores, off-role requests) and addresses them to a security lead or the requester's manager.
- Audit logging: Records every applied grant with requester, scope, policy check, approver, and timestamp in the thread and an optional audit channel.
- Use Case: An engineer posts "need access to the billing repo" in the requests channel; the sweep verifies their team in Okta, prepares a
push grant on that repo, gets approval from a listed approver, applies it, and logs the full trail.
Quick Start
Ask the agent to sweep the access-request channel, check each new request against the role-to-grant policy, and prepare the pending GitHub or AWS IAM grants for approval.
