Transforming Access Management: HubSpot’s Innovative JITA Authorization System

In the realm of access management, HubSpot has made a significant leap forward by redesigning its Just-In-Time Access (JITA) authorization system. This transformation leverages a rule engine architecture that enhances the observability and explainability of access decisions. By shifting from complex conditional logic to an independent set of evaluation rules, HubSpot’s engineers can now track how individual policies contribute to access decisions. This new design helps manage frequently changing authorization requirements seamlessly.

The Complex Landscape of Access Requests

HubSpot’s JITA system handles about 5,500 access requests daily across its workforce of around 10,000 employees. Previously, the authorization framework relied on intricate, conditional logic to account for myriad access scenarios. While effective for existing needs, this setup complicated the process of deciphering why certain requests were either approved or denied. Engineers frequently struggled to pinpoint which specific checks contributed to processing delays, making timely access management a challenge.

Introducing the Rule Engine Architecture

The freshly remodelled system introduces a robust rule engine that evaluates authorization policies as independent rules arranged within a directed acyclic graph (DAG). This innovative structure allows each rule to produce structured outputs, offering insights into evaluation results, execution timing, and metadata. Such clarity assists engineers in understanding the rationale behind authorization decisions. The goal was to shift the focus from merely ensuring functionality to enabling comprehensive explanations for every decision made by the system.

The question wasn’t just does this work? It was Can we explain every decision this system makes, to anyone, at any time?

Enhancing Decision Visibility and Transparency

During the redesign, HubSpot engineers identified visibility into the decision-making process as a crucial requirement. By separating shared request data from individual rules through a common context object, the system efficiently collects user attributes, team information, and request details. This method reduces redundant data retrieval, ensuring that all authorization checks operate with consistent inputs.

Furthermore, the new architecture enhances observability at the rule level, allowing engineers to examine not only the overall request but also individual rule execution times and outcomes. This granular visibility highlights slow evaluations and pinpoints which specific policies may contribute to processing delays.

Robust Error Handling in Rule Execution

Another notable feature of HubSpot’s revised system is its isolated rule execution for managing errors during evaluations. Should a rule fail due to an unavailable dependency or unexpected condition, the failure is logged, while the evaluation of other rules continues unabated. This design ensures that access decisions remain grounded in the results produced by functioning authorization rules, bolstering system resilience.

A Careful Migration Process

The transition from the legacy model to the new architecture was executed carefully. HubSpot engineers ran both the old and the new authorization systems in parallel, allowing real-time comparison of decisions before routing production requests through the redesigned system. Additionally, the team instituted periodic reviews involving stakeholders from security, product, and operations to ensure that the rules remained appropriately scoped and aligned with access requirements.

Comparative Approaches in the Industry

While HubSpot’s innovative approach is making waves, it isn’t the only one addressing access management challenges. Various systems and frameworks are emerging across the industry, such as Open Policy Agent (OPA), which supports a policy-as-code model by separating authorization decisions from application logic. Google Cloud’s Privileged Access Manager zeroes in on the temporary activation of privileged permissions, featuring approval workflows and audit tracking. Microsoft’s Entra Privileged Identity Management provides similar capabilities for managing role activation. However, HubSpot’s implementation distinctly emphasizes application-specific access workflows, with a focus on meticulous rule-level execution visibility.

Conclusion: A Leap Towards Observable Governance

By integrating a rule engine, structured decision metadata, and robust governance processes, HubSpot is effectively transforming its approach to JITA authorization. The transition creates a landscape where access decisions can not only be executed efficiently but can also be thoroughly evaluated, monitored, and reviewed over time.