Request, approve, fulfil and confirm access, and see what the tenant cannot record

Setup

The lesson's request is for a sensitive research database. Here it is the print order archive: past print orders, including customers' delivery addresses. Ava asks for it, Cora approves as her manager, Mia approves as the archive's owner, and Ben fulfils.

1. Open a bash shell and set the variables and helpers from the directory lab, plus READER_ID and READER_SECRET for lab-scim-reader, and look up Ava: export AVA=$(scim -G "$SCIM/Users" --data-urlencode 'filter=userName eq "[email protected]"' | jq -r '.Resources[0].id').

2. Make sure Ben, Cora and Mia can sign in (passwords set on Users), and that Cora and Mia hold no management roles.

3. Planned: once G23 exists, groups gain catalog fields (description, owner, sensitivity, approval chain, longest duration) and can be marked requestable, and tenant users get a request page at $ISSUER/account/access.

Planned walkthrough

1. As administrator, create the group lab-tmp-print-archive and mark it requestable: description "Read past print orders, including customers' delivery addresses. No changes and no exports.", owner Mia, sensitivity High, approvals "manager, then owner", longest duration 180 days.

2. Ava signs in at $ISSUER/account/access, searches for "archive", and requests it with the reason "Reviewing reprint complaints for the moderation team. I need to read past orders for the affected albums." and 90 days. Audit records the submission with the reason and requested end date.

3. The tenant checks the request against separation rules, then routes it to Ava's manager from the enterprise extension, Cora, who approves with a note.

4. It routes on to the owner, Mia, who approves with a note. Fulfilment adds the membership, reads it back from the directory, and marks the request "Fulfilled and confirmed" with the removal scheduled for the end date.

5. Mia requests the same item for herself. The owner step skips Mia and routes to a deputy owner, and the skip is recorded.

6. Cora delegates her approvals to Ava for two weeks. Ava's own renewal routes past Ava to Cora's manager, because the approver is compared with the requester every time a request is routed.

7. On the end date, the tenant removes Ava's membership by itself and records the expiry against the request.

Do today

Every tenant action below is real. The request and approvals live in your notes, because the tenant has nowhere to hold them, and that gap is part of the lesson.

1. Write the catalog entry. In your notes, fill name, technical name (lab-tmp-print-archive), what it allows, intended for, owner (Mia), sensitivity, approvals and longest duration, as in the lesson's table. Create the group in Groups.

Why it matters: this is "Asking for something specific". The entry tells the requester and the approvers what will happen before anything is submitted.

2. Separate deciding from doing. In Roles, create lab-tmp-access-fulfilment with tenant.users.read, tenant.groups.read and tenant.groups.update, and assign it to Ben. Cora and Mia stay without management roles: they decide, they do not change access.

3. The request. In your notes, Ava requests the item with the reason from Planned walkthrough step 2 and a 90-day duration. Write the end date.

Why it matters: this is "A reason and an end". A specific reason lets approvers judge now and lets a reviewer judge later; the end date is set at the start, not remembered later.

4. The approvals. In your notes, Cora approves as manager, then Mia as owner, each with a time and a one-line note. Nothing in the tenant can hold either decision.

Why it matters: this is "Who approves". Each approver answers a different question: does the job need it, and is it right for this resource.

5. Fulfilment. In a private window, sign in at $ISSUER/manage as Ben and add Ava to lab-tmp-print-archive. Audit records tenant.groups.members with Ben as actor.

6. Confirmation from the target. Read the access back with the read-only client.

export TOKEN=$(token_for "$READER_ID" "$READER_SECRET" "$SCIM_SCOPE.read")
scim -G "$SCIM/Groups" --data-urlencode "filter=displayName eq \"lab-tmp-print-archive\" and members[value eq \"$AVA\"]" | jq .totalResults
export TOKEN=$(token_for "$CLIENT_ID" "$CLIENT_SECRET")

The answer is 1. Record "confirmed" in your notes with the Audit event ID from step 5.

Why it matters: this is "Fulfilment". A request is complete when the access exists in the target and has been checked, not when someone says so.

7. Where self-approval slips through. As Ben, add Ben to the group. It succeeds.

Why it matters: the fulfiller could also decide. Only a request engine that compares requester and approver every time it routes a request stops this, which is what Planned walkthrough steps 5 and 6 add.

8. What the record lacks. Open the Audit event from step 5: actor, subject, time and outcome. No reason, no approvers, no end date. Write the lesson's decision trail for the request by hand, and mark which lines came from the tenant.

Why it matters: this is "When approval stops meaning anything". An approval nobody can see later looks exactly like no approval at all.

Break it

1. As Ben, open the group's Members dialog and leave it open. In your own window, remove tenant.groups.update from lab-tmp-access-fulfilment. Ben now removes himself from the open dialog: refused with access_denied, and Audit records tenant.groups.members rejected. Fulfilment needs the permission; approval, today, needs nothing at all.

Restore: add tenant.groups.update back to lab-tmp-access-fulfilment.

Check your work

This lab has no automated checks until its request steps exist. In Audit, Source User directory, look for:

• tenant.roles.create and tenant.users.management_roles.assign for Ben (Do today step 2)

• tenant.groups.members by Ben for Ava, then for Ben (steps 5 and 7)

• tenant.groups.members rejected with access_denied (Break it)

• scim.groups.search by lab-scim-reader (step 6)

Cleanup

1. Remove Ben from lab-tmp-print-archive, then remove Ava at the end date you chose, or now, and delete the group.

2. Remove lab-tmp-access-fulfilment from Ben and delete the role.

Missing infrastructure

• G23: the tenant has no access catalog, no requests with a reason and duration, no approval routing from the manager attribute and the group owner, no self-approval or delegation check at routing time, no automatic fulfilment with read-back confirmation, no scheduled expiry, and no request or approval events in Audit. Once they exist, the Planned walkthrough replaces your notes, and Do today step 8's decision trail comes from the tenant itself.