Access requests
An access request is time-boxed permission to run operations or a debug session on one deployment. Someone else approves it, and it ends on its own:
alien access-requests create --deployment customer-1/us-east-1 \
--operation 'kubernetes/*' --max-risk read-only \
--debug-tool kubectl --debug-namespace checkout \
--duration 2h --reason "Checkout pods restarting"
alien access-requests wait ar_5k2m8qYou need an access request when an operation's approval rule is manual or missing, and for every debug session. One approved request covers a whole fix for up to 6 hours, so nobody approves each step.
Sequence diagram. Lanes: Your team (engineer or agent), Alien (access requests), Approver (kubectl or Slack). Steps: 1 · request; queued; 2 · ask; 3 · approve 6h; 4 · run until expiry.
The requester asks, someone else approves, and the grant ends on its own when the window closes.
Scope
A request covers one or more of:
| Grant | Flag | Covers |
|---|---|---|
| One exact operation | --operation kubernetes/restart-pod --params '{…}' | That operation with those parameters. |
| A plugin wildcard | --operation 'kubernetes/*' --max-risk read-only | Every operation the plugin exposes now, up to the risk cap. Operations added to the plugin later aren't included. |
| A debug tool | --debug-tool kubectl --debug-namespace checkout | A debug session with kubectl, aws, gcloud, or az, scoped to a namespace or cloud account. |
A wildcard request requires --max-risk (read-only, mutating, or destructive); the CLI refuses one without it. A wildcard can reach mutating only when the plugin's * approval rule sets maxRisk that high. See Operations.
Only the requester can use an approval. A teammate can't use yours, and a request an API key created works only for that API key.
Window
--durationsets how long you ask for. The maximum is 6 hours, which is also the window Slack andkubectlapprovals offer by default.- An approval never extends past the requested deadline.
- An approved request for one operation covers only the exact operation and parameters in the request.
alien access-requests waitwaits up to 3600 seconds by default (--timeout).
Statuses
| Status | Meaning |
|---|---|
| Pending Approval | An AI agent proposed the request. A teammate must send it to the customer first. |
| Queued | Waiting for the customer's decision. Requests you create from the CLI start here. |
| Customer Approved | Granted until the window ends. |
| Rejected | Denied. Request again if you still need access. |
| Expired | The window ended, or nobody approved it in time. |
| Revoked | Withdrawn before the window ended. |
Find every request under Operations → Access Requests.
Who approves
Someone other than the requester always approves. Who that is depends on the platform:
| Platform | Approver | Where |
|---|---|---|
| Kubernetes | The customer | In their cluster with kubectl, or in Slack |
| Every other platform | A workspace member other than the requester | In the dashboard (Approve access request?), with alien access-requests approve, or in Slack |
On Kubernetes, the Operator creates the request as a custom resource in the customer's cluster. alien access-requests create and wait print the command the customer runs. It looks like this:
kubectl patch <access-request-resource> req-ar-5k2m8q -n checkout --type=merge \
-p '{"spec":{"approvedForMinutes":360}}'In Slack, the approval card offers Approve for 6 hours and Deny. See Slack and the AI agent.
On other platforms, a teammate signed in with alien login decides from the CLI. An API key can't approve or deny.
alien access-requests approve ar_5k2m8q --duration 2h
alien access-requests deny ar_5k2m8q--duration defaults to the longest window the request allows. deny asks for confirmation; pass --yes in scripts.
Revoke
Revoke a grant as soon as the work is done:
alien access-requests revoke ar_5k2m8q --reason "incident resolved"Or select Revoke on the request in the dashboard. Revoking takes effect at once:
- operations still waiting to be dispatched fail
- open debug sessions stop
- operations already running finish
- the request can no longer be approved
You can't revoke an expired or rejected request.
Next
Operations
The built-in operations catalog, risk tiers, approval rules in alien.ts or Helm values, and how to build and publish your own plugin.
Debug sessions
Run kubectl, aws, gcloud, or az against one deployment with scoped, time-boxed credentials, and open a shell on Machines and local deployments.