Time-Bound Secret Access
Design a request and approval flow for temporary production-secret access with purpose, scope, and automatic expiry.
The brief
Understand the problem
Background
Engineers sometimes need privileged access during an incident or maintenance task. Permanent grants increase risk, while slow manual coordination can delay recovery. The request must distinguish viewing a value from using it through a controlled session.
User context
On-call engineer Ada needs fifteen minutes of access to a production signing operation during certificate recovery. She should not be able to export the underlying private key.
Product problem
The system needs to grant the minimum viable capability quickly while preserving independent approval, monitoring, and reliable expiry.
Objective
Create access request, risk-aware approval, controlled use, and expiry review for a protected secret operation.
What to design
Define the experience
Required experience
- Request a specific capability, resource, purpose, and duration
- Let an authorized reviewer inspect context and risk
- Use the approved capability in a monitored session
- Confirm automatic expiry and review the access record
Screens and states
- Secret access request
- Approval review
- Active privileged session
- Expiry and audit summary
Core user flow
Follow the critical path
- 01
Ada requests signing capability for one production certificate and links the incident
- 02
The security approver verifies her on-call role and reduces duration to fifteen minutes
- 03
Ada performs the operation without revealing the key value
- 04
Access expires automatically and both parties review the recorded actions
Product rules
Requirements and constraints
Requirements
- Separate secret viewing, copying, and controlled-use capabilities
- Show requested scope, reason, duration, requester context, and policy risk
- Require independent approval for protected production resources
- Display remaining time and record actions without capturing secret material
Constraints
- Expiry cannot depend on the user's browser remaining open
- Approval cannot exceed the reviewer's authority
- Break-glass access needs a distinct policy and retrospective review
Reality check
States worth considering
Finish line
What to deliver
- Four desktop screens covering controlled use and automatic expiry
If you want more
Optional extensions
Optional direction
Visual resources
Use these as a starting constraint if you want one. They are not part of the required solution.
Roboto Condensed & Cabin
Clear interface writing gives people the confidence to understand what changed and decide what to do next.
Roboto Condensed & Cabin
Clear interface writing gives people the confidence to understand what changed and decide what to do next.