What is time-limited (JIT) privileged access? A guide for remote desktops and servers

Time-limited access, also called JIT (just-in-time) access, is an approach where high-privilege access to a server, virtual machine or desktop is opened only for the period a task needs, instead of being granted permanently. When the time runs out or the work ends, access closes; a new task needs a new decision.

Cerberus applies this per resource: access is assigned to a person for a specific resource with an end time or a usage budget, a session starts with approval when the active session policy requires it, and when access is revoked the outcome is written to the records.

What is JIT access?

In JIT access, privilege is not written to an account permanently. It is lent for a task. Three properties separate it from standing access:

• The scope is narrow. Access is limited to the resource the work happens on, not the whole network or every server.
• The duration is defined. Access has an end condition, set when access is granted.
• The decision is traceable. When someone later asks who accessed what, why and for how long, the records answer.

“Privileged” here means access beyond ordinary user work: server administration, maintenance, installation, emergency response.

How does time-limited access differ from standing access?

With shared servers, contractor accounts and maintenance windows, standing access accumulates over time. An end condition stops that build-up.

How does the JIT access cycle work?

The cycle has four steps.

1. Request. The person or an authorized administrator states which resource needs access and for how long.
2. Approval. When the active session policy requires it, an authorized user reviews the request, confirms the person, resource and requested duration, then approves or rejects it.
3. Expiry. When the time runs out, or the work ends early, the decision to start new sessions closes.
4. Revocation. If needed, an administrator ends access before the time is up and closes the open session.

Decisions, assignment changes, session lifecycle and closure events can be reviewed afterwards.

How does JIT access work in Cerberus?

In Cerberus, time-limited access is part of the assignment and session decision:

• Time-limited assignment. When creating an invitation or member access, the timed access option is switched on. There are two ways to limit it: an end time or a usage budget. The duration can be extended if the work runs long; extending does not add resources. The steps are in the time-limited access guide.
• Session approval. When the active session policy requires approval, a session request reaches an authorized user with the person, resource and requested duration. Approval sets the permitted duration; rejection opens no session. The flow is on the session approvals page.
• Session policy. Duration, working mode, clipboard, file transfer and closure behavior are set by session policies. The policy defines how the working surface behaves after the decision.
• Revocation and records. Removing the assignment, ending the active session and withdrawing resource readiness are separate operations, and each outcome stays visible. Details are on the revocation and evidence page.

The resource itself is opened in the browser over RDP, SSH or VNC. In the normal flow, users are not given a raw IP, hostname or port; the session opens through a Cerberus decision.

What happens to an open session when time runs out?

Expiry closes the person’s decision to start new sessions. A session already running is a separate matter: an authorized user ends it from the active session view and watches the result. If the end request fails, the product does not mark it as a successful closure; the error stays visible and a controlled retry follows.

So when planning time-limited access, two questions go together: when does access end, and who closes an open session at that point?

What does JIT access not solve?

Knowing the limits sets the right expectations:

• It does not protect credentials. Time-limited access does not by itself answer where shared passwords are kept. That belongs to the model on the credential custody page.
• It does not open an unready resource. Without resource readiness, assignment and policy, no session opens; time does not replace those conditions.
• It does not produce session video. Records contain decision, start, state change, revocation and closure events. Session recording is in development.
• It does not deliver regulatory compliance. Time-limited access is one control used to answer “who accessed what, when and under which decision”; it does not produce a compliance outcome on its own.

How is JIT access different from a VPN or a shared account?

A VPN brings a person into the network; which server they enter, and when, is a separate question. A shared administrator account detaches access from the person: whoever has the password gets in. Time-limited access turns the question around: which person can work on which resource, and for how long. Cerberus keeps that answer in the assignment and (when the policy requires it) approval decision. Which part of the job network, remote desktop, PAM and gateway tools each cover is covered separately in the comparison guide.

In short, time-limited access is not a separate product layer replacing a network or password tool. It is the decision that governs the person-resource-time relationship.

When is JIT access useful?

• Outsourced maintenance. A vendor technician enters a specific server only during the maintenance window.
• Shared test machine. Several people work on the same resource at different times; each person’s access ends with their own duration.
• Emergency response. An on-call engineer gets access for the incident and access closes when the incident does.

For the flow of these scenarios see use cases; to bring a resource into Cerberus follow connecting a machine.

Try time-limited access

You can walk through time-limited assignment, session approval and revocation in the live demo: open the demo.