Instant Gate
A dynamic role on the session, only for the approved window.
PLATE 02
Privilege only inside the window
Not left on
A privilege granted for the job and left on overnight is the privilege an attacker uses. Instant Gate names the object and the window for each request, and turns the role on only inside that window.
Sequence
- Request — the privilege, the object, and the time window.
- Approval — an approver reviews it. This can line up with an existing work ticket.
- AUTH-KEY — each work session gets a temporary key. The key cannot be taken and used from another session, and it expires.
- Activate —
apply_my_rolesin the database session turns the dynamic role on for that session only. Every SQL action after approval is written to a detailed trace. - Revoke — when the window ends or the session closes, the role is removed.
Client tools
No dedicated client. Connect with the SQL tool you already use: DBeaver, SQL Developer, or PL/SQL Developer.
If TLS or native network encryption hides the packet, the approved role and the session trace still record the SQL that ran.