Access Control vs. Access Request Management
People throw around "access control" and "access request management" like they mean the same thing. They don't. Mixing them up is how you end up with security gaps and finger-pointing when something goes wrong.
- Access control is the big picture.
It's every policy, system, and rule that decides who gets into what. In ITSM, access control includes your identity systems (Active Directory, Okta), your application security, your network controls, and your tracking systems.
- Access request management is one piece of that puzzle.
Access request management is the ITSM workflow that handles permission changes.
Does someone need access they don't have? They submit a request. That request gets reviewed, approved or denied, then put in place. It's the day-to-day workflow inside your bigger access control setup.
Here's where many teams screw this up: they build a slick access request system in JSM and think they've solved access control. Wrong.
You've solved the "how do we change permissions" problem. You still need policies defining what permissions make sense, tracking to catch misuse, and cleanup processes to remove old access.
The key is designing them to work together. Access control sets the rules, proper access request management enforces them day-to-day.
The Access Request Process
Effective access request management follows a straightforward path from request to cleanup. Here's how it actually works:
Request submission happens through your service portal.
Users pick what they need from a catalog, fill out a form explaining why they need it, and specify how long they need access. No more email chains or hallway conversations just to request access.
Review and approval routes the request to the right people.
Manager approval for basic app access. Security team review for admin privileges. App owner sign-off for system-specific permissions. The system knows who needs to approve what based on your established access management processes.
Provisioning creates the actual access once it's approved.
This might be automatic through system integration or manual work by IT staff. Either way, someone verifies the access works and doesn't conflict with other permissions.
Tracking logs every step.
Who requested what, who approved it, when it was set up, whether it's being used. This audit trail becomes critical during security incidents or compliance reviews for access request management.
Regular reviews to verify access request settings.
Quarterly reviews for sensitive systems, annual reviews for everything else. Managers get lists of their team's permissions and decide what to keep or remove.
Deprovisioning removes access when it's no longer needed.
The cleanup part of access request management, and happens during role changes, project completion, or people leaving the company. This should happen automatically when possible, manually when it can't be automated.
Emergency procedures handle urgent requests that can't wait for normal approval.
Break-glass access with immediate provisioning and post-incident review. Critical for production issues and security incidents.
The key is making legitimate requests fast and easy while maintaining proper controls. If your process for access requests is too slow or complicated, people will find ways around it.
Risks of Unmanaged Access Requests
When access requests fall through the cracks, the damage goes far beyond frustrated users. Here's what actually happens when you don't manage access requests properly:
Permission creep turns everyone into admins.
People get access for projects, temporary assignments, and one-off requests. Projects end, assignments change, but the access stays. Your service desk agent still has database admin rights from a project six months ago. Your network engineer has finance system access from when they helped with an audit.
Orphaned accounts become attack vectors.
Contractors finish their work but keep system access. Employees change roles but retain permissions from their old job. Ex-employees sometimes keep access for months after leaving. When these accounts get compromised, attackers inherit all that forgotten access.
Compromised security can lead to threats like data leaks.
The disgruntled employee planning to quit knows they can still access data and systems they shouldn't. The finance analyst accidentally deletes customer records because they have write access to a database they thought was read-only. Everything from sensitive data breaches to malware attacks, system hackers, and all sorts of online attacks can come from failing to manage access requests.
Compliance violations pile up fast.
Auditors want proof of who has access to what, when they got it, who approved it, and when it was last reviewed. For instance, SOX compliance requires separation of duties - if you can't prove your controls prevent conflicts, you've got a material weakness and potential risks of non compliance. If your access management runs on email chains and spreadsheets, you can't provide that documentation.
Operational disasters happen at the worst times.
Critical access gets removed by mistake during cleanup. Emergency access isn't available when systems go down. The on-call engineer can't reach monitoring systems during a major incident because their elevated access expired.
Shadow IT spreads when official processes fail.
If getting approved access takes weeks, people find workarounds. Suddenly you have business-critical data in unauthorized cloud services because your access process was too slow or complicated.
Productivity losses compound daily.
New employees wait days for system access. Project teams miss deadlines because they can't reach shared resources. Your IT team spends time on manual access tasks instead of strategic work.
The real cost is the stuff you can't measure easily - missed opportunities, damaged reputation, and the constant firefighting that comes from uncontrolled access.
Types of Access Requests in IT Service Management
IT service management deals with several distinct types of access requests, each requiring different approval workflows and security considerations:
- Application access requests are the most common. Marketing needs the customer database, new developers need GitHub permissions, finance needs read access to monitoring dashboards. Usually requires manager approval and app owner sign-off after user submits request.
- Administrative privileges need more scrutiny and stricter security policies before you grant access. Domain admin rights for server maintenance, database admin access for troubleshooting, JSM admin permissions to modify workflows. Always requires security team review and time-limited access when possible for privileged users.
- Temporary elevation happens during incidents or maintenance. Network engineer needs firewall access for 2 hours to fix routing issues, service desk agent needs elevated privileges to resolve a critical ticket. Should auto-expire and get logged for review to minimize security risks.
- Cross-departmental data access creates complexity. Sales needs customer support ticket data for account reviews, HR needs IT asset information for compliance reporting. Requires data owner approval and clear usage restrictions especially with confidential data.
- Project-based access comes with built-in expiration dates for user activity. New monitoring system project needs vendor portal access, shared documentation, and test environments for six months. Should be tied to project lifecycle with automatic cleanup.
- Emergency access bypasses normal workflows during critical incidents. Break-glass accounts for system administrators, emergency database access for major outages. Requires immediate post-incident review and justification.
- Vendor and contractor access needs special handling. External support gets limited JSM access for specific issues, consultants get temporary access to project resources. Always time-bounded with restricted permissions.
- Service account access often gets forgotten. Applications need database connections, monitoring tools need system access, backup software needs file permissions. Requires regular review since these accounts don't have human owners.
Each type needs its own approval chain, provisioning method, and cleanup procedure, so you need to design workflows that match the risk level and business need.
Manage Access Requests with Automation
Automation takes the manual grunt work out of efficiently managing access requests. Instead of you manually creating accounts, assigning permissions, and chasing down approvals, the system handles routine decisions automatically.
Users request what they need through standardized workflows, approvals flow to the right people, and permissions get set up without anyone touching a keyboard.
The benefits are obvious once you see it working. Users can request access faster, you eliminate human errors, secure access policies get enforced consistently, and your IT team can focus on actual problems instead of routine provisioning tasks. It's the difference between spending your day creating user accounts and spending it on strategic projects.
Now let's look at what you can actually automate in your environment.
Self-Service Portal for Access Requests
This is basically an internal app store for your organization's access requests. Your users can browse available applications - GitHub, Google Workspace, Figma, HubSpot, Zendesk - right from your ITSM portal. They pick what they need, explain why they need it, and hit submit to gain access. No more hunting down app owners or wondering who approves what with a self service interface.
The portal shows exactly what access level they're requesting - GitHub contributor access, Google Workspace Business license, Figma team membership - so there's no confusion about what they're actually getting. Users can also see approval timelines and track formal request status in real-time.
Auto-Approve Low Risk Access
Standard requests get approved automatically based on predefined rules. Active Directory group membership for new employees, read-only database access for analysts, or basic Jira project permissions. The system checks the request against your policies and provisions access immediately if everything matches.
This handles routine stuff like adding developers to the "Engineering" security group or giving finance users access to expense management tools. Unusual requests like admin permissions or cross-departmental database access still get flagged for manual review.
Automate Multi-Stage Approvals
Complex requests flow through multiple approvers without manual coordination. Database admin access might need manager approval, then DBA team review, then security team sign-off. Network infrastructure access requires both network team and security approval before provisioning.
The system handles escalation when approvals sit too long and routes to backup approvers during vacations. It also enforces approval order - security can't approve until the technical team has reviewed the request.
Implement Zero-Touch Provisioning
Once approved, access gets created automatically across your systems. Active Directory accounts get provisioned, security group memberships get assigned, application permissions get configured through APIs. Database user accounts get created with appropriate role assignments.
Tools like Multiplier handle the technical implementation between JSM approval workflows and actual system provisioning. Your approval in JSM triggers automatic user creation in Okta, group assignments in applications, and permission grants in databases.
Automate Least Privilege Access
New users start with minimal permissions based on their role definition. Developers get GitHub read access and staging environment permissions, not production database admin rights. Service desk agents get incident management access, not change approval permissions.
Temporary elevated access expires automatically. Emergency production access for debugging gets revoked after 4 hours. Temporary project permissions for vendor system access get removed when the project closes. No more forgotten admin accounts from one-time maintenance tasks.
Automate Employee Lifecycle Workflows
HR system changes trigger automatic access adjustments. New employee records create standard access requests based on department and role. Role changes remove old Active Directory group memberships and add new ones, or they can request additional access. Departure records immediately disable user accounts and create cleanup tasks for the former team member's accounts.
Integration between your HR system and identity management handles the technical details. When HR marks someone as terminated, their Active Directory account gets disabled, VPN certificates get revoked, and application access gets suspended within minutes.
Aside from mitigating internal threats, this also saves you time and helps you standardize your access request process.
Conduct Periodic Reviews Automatically
The system identifies unused permissions and sends targeted questions to managers. "This user hasn't accessed the finance database in 90 days - remove access?" instead of giant spreadsheets asking about dozens of systems managers don't understand.
Access review automation tracks login patterns, identifies dormant accounts, and flags permissions that haven't been used recently. Managers get specific, actionable questions they can answer quickly and accurately.
Automate Manager Approvals
Requests route to the correct approvers based on organizational hierarchy and system ownership. Database access requests go to the DBA team lead, network permissions route to infrastructure managers, application access goes to the relevant product owner.
The system knows your org chart and handles delegation during absences. When the database team lead is unavailable, requests automatically route to the backup approver. Escalation rules ensure nothing sits in approval queues indefinitely.
Pick your most time-consuming manual business processes first, automate those, then expand from there.
User Access and Role-Based Access Control (RBAC)
All this automation for access requests works best when you have a solid foundation underneath. That's role-based access control. Assigning roles introduces predictable, manageable patterns to user access management.
RBAC assigns permissions based on job functions, not individual requests. Let's say you're onboarding a backend developer, and they need:
- GitHub repository access
- Production database read access (for debugging, no write permissions)
- Staging/development database full access
- AWS development environment access (EC2, RDS, S3 buckets for dev/staging)
- Docker Hub pull/push permissions for container images
- Jenkins/CI pipeline access for builds and deployments
- Application monitoring tools
- Logging systems (Splunk, ELK stack, application logs)
- API documentation and testing tools (Postman, Swagger)
- Slack engineering channels and incident response channels
- Jira access (development project, bug tracking, story assignment)
- VPN access for remote development environment connections
- Development server SSH access
- Development IDE licenses
- Internal development documentation (Confluence, internal wikis)
- Staging environment application admin access
- Database migration tools and version control
Role-based access bundles them all into the "Backend Developer" role. Instead of requesting 17 different permissions, the new hire gets assigned to that role and inherits everything they need. Vice versa when they leave – you remove them from the role, and the access goes away with it.
When your access request system knows what roles exist and what permissions each role should have, it can make intelligent decisions automatically.
Set Your Access Request Management on Auto-Pilot
Access request management feels overwhelming when you're looking at all the moving parts - approval workflows, role definitions, automation rules, lifecycle integration.
But here's the thing: once you have a proper system in place, it basically runs itself.
Multiplier makes this transition practical for your JSM environment. Instead of you building complex integrations between approval workflows and actual provisioning, Multiplier handles the technical implementation while you focus on the process design.
Your JSM workflows become the control center for access management across your entire environment.
Book a demo to see how it works with your existing JSM setup, or install it from Atlassian Marketplace for a free 30-day trial.
