What problem are you trying to solve?

Focus on the what and why of the need you have, not the how you'd like it solved.

• Overly broad project-level roles force us to grant access to all databases, violating the principle of least privilege for our sensitive data.

• High operational overhead and lack of native workflows for securely provisioning, approving, and revoking temporary database access.

What would you like to see happen?

Describe the desired outcome or enhancement.

• The ability to assign database-specific, fine-grained access policies directly to federated Project Users (via Okta), rather than relying on broad anyDatabase project roles.

• A native UI workflow within Atlas where users can request time-bound access (e.g., 2 hours) to specific databases or roles.

• An integrated approval routing system where an admin can approve the request, triggering Atlas to automatically provision and subsequently revoke the access once the time expires.

• Audit and track real user actions

Why is this important to you or your team?

Explain how the request adds value or solves a business need.

• It is critical for enforcing the Principle of Least Privilege and maintaining security compliance. We must ensure general project users can access standard operational data while being explicitly denied access to sensitive data (like our "finance" database).

• A native JIT workflow heavily reduces operational overhead. It eliminates the need to build complex custom automation, manage manual access tickets, or procure expensive third-party Privileged Access Management (PAM) tools just to handle temporary database access safely.

• Tracking users' behavior during their elevated priviledge is key

What steps, if any, are you taking today to manage this problem?

• To achieve fine-grained access, we currently have to map Okta groups to custom database roles, which fragments the user management experience away from the standard Project UI.

• For temporary access, we are forced to rely on external complex setups like Okta Identity Governance (OIG), custom API scripts utilizing the expirationDate field, or highly manual administrative provisioning and de-provisioning.