Access grant workflow (internal agent) — record_processedAction contract

The agent may grant access only to a person HR lists as active, only to an allowed group, and for at most 90 days. A successful grant must show up as a group membership in the identity provider, a closed access request and a notification to the person's manager, within 15 minutes. One grant per request, at most twenty grants per agent per day. A membership removed within an hour of being granted, or a person who leaves while still holding the access, fails the grant.

Contract ID: access_grant_workflow
Source: internal://policies/access
Retrieved: 2026-10-11
Notes: Template values. Replace with your access policy and the groups your security team allows an agent to grant.

What the contract checks

Each block is evaluated against read-only facts from the systems of record. The agent's own report is never used as evidence.

Contract YAML

The machine-readable action contract: allowed action, required inputs, preconditions, limits, expected and forbidden effects, window. Sign in to select it for your tenant or fork it.

# Access grant workflow — action contract for an agent that gives a person access to a system.
# Internal policy template: rename the systems (idp, hr, tickets) to your identity provider, your HR system and
# your ticketing tool. The reversal here runs the other way: the thing that must happen later is the revocation.
id: access_grant_workflow
version: 1
kind: action
vendor: internal
vendor_display: "Access grant workflow (internal agent)"
action_type: grant_access
outcome_type: record_processed
claim_source: agent.actions
subject_kind: person
description: >
  The agent may grant access only to a person HR lists as active, only to an allowed group, and for at most 90
  days. A successful grant must show up as a group membership in the identity provider, a closed access request
  and a notification to the person's manager, within 15 minutes. One grant per request, at most twenty grants per
  agent per day. A membership removed within an hour of being granted, or a person who leaves while still holding
  the access, fails the grant.
source_citation:
  url: "internal://policies/access"
  retrieved: "2026-10-11"
  title: "Internal access policy (template)"
  notes: >
    Template values. Replace with your access policy and the groups your security team allows an agent to grant.
unknown_fields: []
action:
  window: "15m"
  preconditions:
    - state_before_action:
        source: hr
        type: employment_status
        where: {status: active}
        message: "HR does not list the person as active"
  limits:
    - param_in: {param: group, values: [support-readonly, analytics-viewer, build-logs]}
    - param_max: {param: duration_days, max: 90}
  aggregate_limits:
    - aggregate_exceeds:
        source: idp
        type: membership_added
        max: 20
        over: "24h"
        by: agent
        message: "This agent has granted more than twenty memberships in a day"
  expected_effects:
    - effect_observed:
        source: idp
        type: membership_added
        message: "The identity provider shows no new membership"
    - effect_observed:
        source: tickets
        type: request_closed
        message: "The access request was not closed"
    - effect_observed:
        source: messaging
        type: manager_notified
        message: "The person's manager was not notified"
  forbidden_effects:
    - effect_count_exceeds: {source: idp, type: membership_added, max: 1}
    - effect_attr_differs:
        source: idp
        type: membership_added
        attr: duration_days
        equals_param: duration_days
        message: "The membership was granted for a different duration than requested"
  reversed_by:
    - effect_observed:
        source: idp
        type: membership_removed
        within: "1h"
        message: "The membership was removed within an hour of being granted"
    - effect_observed:
        source: hr
        type: employment_ended
        within: "90d"
        message: "The person left while still holding the access"
  unverifiable_if:
    - missing_fact_source: [idp, hr]
billing:
  unit_price: 0
  currency: USD

Use this contract See it applied in a sample verification